Keynote sketch from the intro of AI Now Summit, the very first conference of my company @MistralAI! Introducing tons of stuff including our very own @mistralvibe new work and code modes!!
Microsoft is investigating mistralai PyPI package v2.4.6 compromise. Attackers injected code in mistralai/client/__init__.py that executes on import, downloads hxxps://83[.]142[.]209[.]194/transformers.pyz to /tmp/transformers.pyz, and launches a second-stage payload on Linux. The file name transformers.pyz appears deliberately chosen to mimic the widely used Hugging Face Transformers library and blend into ML/dev environments.
The main payload is a credential stealer, but it also includes country-aware logic; it avoids Russian-language environments and contains a geo fenced destructive branch that has 1-in-6 chance of executing rm -rf / when the system appears to be in Israel or Iran.
To mitigate this threat: isolate affected Linux hosts, block 83[.]142[.]209[.]194, hunt for /tmp/transformers.pyz, pgmonitor[.]py, and pgsql-monitor.service, and rotate exposed credentials.
Since launching Voxtral Realtime, the community response has been remarkable. Today, we share the technical report, launch the Realtime playground in Mistral Studio, and share the model in Hugging Face Transformers. 🧵
@MegaBasedChad@MistralAI we've updated the CTA on our docs page to redirect to our console (https://t.co/mLbmb3e9Xc) rather than our contact form
lmk if you run into any issues happy to take a look
🚨🤖Mistral AI job posting. If you want to help training the best robotics VLA models in Europe, DM me. Roboticists, AI scientists, engineers, hardware specialists, developers. 📍Paris, London, Palo Alto.