Giulio

Nulla è reale, tutto è lecito

[Formula 1 @F1]

You've just won in Monaco, Kimi! 👏🏆

#F1 #MonacoGP

[Giulio @SottileGiulio]

@SkySport per quanti anni?

[Formula 1 @F1]

KIMI ANTONELLI WINS IN MONTREAL!! 👏🏆

WHAT A RACE! 🤯

#F1 #CanadianGP

[Giulio @SottileGiulio]

niente da fare con SuperGrok lite, ho tolto l'abbonamento. rispetto alla versione gratuita non cambia nulla e l'aiuto che offre è insufficente rispetto ad altre AI come Gemini per Android Studio
le immaggini ho dato 2 prompt e avevo già raggiunto il limite
peccato

[Giulio @SottileGiulio]

I just earned the Python certification @freeCodeCamp! Check it out here: https://t.co/4ZHfyvQDBX

[Giulio @SottileGiulio]

figurati se mi considerano

[Giulio @SottileGiulio]

giorno 3
creare un'app con grok non è per niente semplice, continua a darmi codice in cui mancano o import o dependencies

[Giulio @SottileGiulio]

continua nella sua confusione solitaria
gli forniscono gli import e lui li toglie io boh
ps gli import me li ha dati direttamente Android Studio
io sono più ignorante di @grok in programmazione
@xai c'è da migliorare

[Giulio @SottileGiulio]

non so chi è più confuso, io o "superGrok" ahahah

[Giulio @SottileGiulio]

faccio un test con supergrok lite
voglio vedere quanto ci metto per creare un'app da zero senza esperienza in android studio e linguaggio Kotlin

[Giulio @SottileGiulio]

faccio un test con supergrok lite
voglio vedere quanto ci metto per creare un'app da zero senza esperienza in android studio e linguaggio Kotlin

[Giulio @SottileGiulio]

@MarioNawfal C'era una volta l'arte

[notmyname1999 @notmyname113432]

600 million copies sold. More than Rothbard, Mises, Hayek, and Rand put together. One Piece is the most read libertarian work ever created. And it carries the exact same core principles on its back: freedom as
a non-negotiable, cooperation that's never coerced, and a deep structural hostility toward centralized power. Except Oda doesn't write essays. He writes a boy who punches tyrants when they make someone cry and 600 million people understood the message without ever hearing the word "libertarianism". A thread 🧵 1/9

[Giulio @SottileGiulio]

@crypto_gateway Btc no kyc? Let's go!

[Giulio @SottileGiulio]

@calciomercatoit La nazionale non ha insegnato niente quindi?

[Formula 1 @F1]

Win #2 🏆🏆

#F1 #JapaneseGP

[Giulio @SottileGiulio]

@calciomercatoit abbiamo giocato di merda, sia tecnicamente che tatticamente, ma la speranza è l'ultima a morire

[Giulio @SottileGiulio]

@WalkerAmerica I like fiat

[Giulio @SottileGiulio]

@Fidias0 europe is fucked

[Giulio @SottileGiulio]

Damn!

[Aakash Gupta @aakashgupta]

Someone just poisoned the Python package that manages AI API keys for NASA, Netflix, Stripe, and NVIDIA.. 97 million downloads a month.. and a simple pip install was enough to steal everything on your machine.

The attacker picked the one package whose entire job is holding every AI credential in the organization in one place. OpenAI keys, Anthropic keys, Google keys, Amazon keys… all routed through one proxy. All compromised at once.

The poisoned version was published straight to PyPI.. no code on GitHub.. no release tag.. no review. Just a file that Python runs automatically on startup. You didn’t need to import it. You didn’t need to call it. The malware fired the second the package existed on your machine.

The attacker vibe coded it… the malware was so sloppy it crashed computers.. used so much RAM a developer noticed their machine dying and investigated. They found LiteLLM had been pulled in through a Cursor MCP plugin they didn’t even know they had.

That crash is the only reason thousands of companies aren’t fully exfiltrated right now. If the code had been cleaner nobody notices for weeks. Maybe months.

The attack chain is the part that gets worse every sentence.

TeamPCP compromised Trivy first. A security scanning tool. On March 19. LiteLLM used Trivy in its own CI pipeline… so the credentials stolen from the SECURITY product were used to hijack the AI product that holds all your other credentials.

Then they hit GitHub Actions. Then Docker Hub. Then npm. Then Open VSX. Five package ecosystems in two weeks. Each breach giving them the credentials to unlock the next one.

The payload was three stages.. harvest every SSH key, cloud token, Kubernetes secret, crypto wallet, and .env file on the machine.. deploy privileged containers across every node in the cluster.. install a persistent backdoor waiting for new instructions.

TeamPCP posted on Telegram after: “Many of your favourite security tools and open-source projects will be targeted in the months to come.. stay tuned.”

Every AI agent, copilot, and internal tool your company shipped this year runs on hundreds of packages exactly like this one… nobody chose to install LiteLLM on that developer’s machine. It came in as a dependency of a dependency of a plugin. One compromised maintainer account turned the entire trust chain into a credential harvesting operation across thousands of production environments in hours.

The companies deploying AI the fastest right now have the least visibility into what’s underneath it.