CISA flags exploited LiteLLM MCP auth bypass; patch to 1.84.0
An arbitrary Bearer token opens any connected MCP tool; CISA set a Sept 16 deadline. Plus code-review model data, Astra's hidden reasoning, Assistant's sunset.
Copy markdown
One bad Bearer token = full MCP access
CVE-2026-59822 (CVSS 8.8): LiteLLM's MCP OAuth2 passthrough fallback accepts any Bearer token as a valid session, letting an unauthenticated caller list and invoke every configured MCP tool and pivot to the services behind them. Fixed in v1.84.0.
Patch by Sept 16, or block /mcp/
CISA added the flaw to its Known Exploited Vulnerabilities catalog on Sept 2 with a Sept 16 federal fix deadline, citing active exploitation that drops reverse shells and crypto miners on AI infra. Can't upgrade yet? Disable MCP routes or block /mcp/ at your gateway.
You're not the only one in the batch
The same KEV update flagged Kludex Starlette and Kestra OSS, the ASGI and orchestration layers many agent stacks sit on. If you run either, check your version too; one security digest noted these additions landed with almost no coverage.
Astra vs Opus 5 in code review
CodeRabbit's own eval puts GPT-6 Astra ~22% ahead of Claude Opus 5 on bugs caught (20% on cross-file reviews), but at ~$1.50 per illustrative review versus $0.032 for its cheaper Luna tier. Astra offers zero data retention for eligible customers; Fable defaults to 30-day.
Astra reasons where monitors can't follow
OpenAI's 117-page system card says Astra's 'recurrent depth' loops tokens through the same layers to reason in latent space, and its ability to shape its own chain-of-thought jumped to 60.9% (16.1% for Sol) as monitorability 'decreased.' CoT-based safety tooling may catch less than it used to.
'Hey Google' now routes to Gemini
Google started pulling Google Assistant from Android, Wear OS and Android Auto on Sept 4, with Gemini taking over the voice trigger. If you ship voice-triggered app integrations, retarget them at Gemini rather than Assistant endpoints.