This Week in AI: Agent Skills Goes to a Foundation, LiteLLM Ships a Credential Stealer

The agent standard used by more than 70 platforms changed owners. Anthropic donated Agent Skills to the Agentic AI Foundation, a Linux Foundation affiliate, on October 22, and the name, the logo, the GitHub organization, and the agentskills.io domain hosting the spec moved with it. The day before, version 1.107.0 of LiteLLM, a package downloaded 23 million times a week, sat on PyPI and Docker for more than two hours with code that collected SSH keys, cloud credentials, and provider API keys.

Here are seven items from October 19 through October 24.

1. The Agent Skills standard moved to a Linux Foundation affiliate

Anthropic announced on October 22 that it was donating Agent Skills to the Agentic AI Foundation. Agent Skills is a file format for writing down "here is how this job gets done" for an agent. Write one once and the same file runs in ChatGPT, GitHub Copilot, Cursor, and VS Code, not only in Claude. The AAIF is the foundation Anthropic set up last year with Block and OpenAI, and MCP sits there too.

From here, engineers from Anthropic, Google, OpenAI, and others maintain the spec as individuals, with David Soria Parra and Mahesh Murag as lead maintainers. Anthropic published a draft roadmap covering versioned spec releases, a formal process for proposing changes, and security guidance for the people who install and run skills.

Skills already in use keep working, and the announcement states that you can continue to use the standard or contribute to it without joining the AAIF. There is no plan tier or region condition. Pick one SKILL.md you have only ever run in Claude, drop it into Copilot or Cursor unchanged, and check whether the output matches. That single test tells you whether the standard really crosses tools.

2. LiteLLM 1.107.0 shipped with code that harvested credentials

LiteLLM is a relay that lets you call many AI models through one interface, and it is downloaded 23 million times a week. Version 1.107.0 went up on PyPI and the Docker latest tag on October 21. According to Socket's analysis, on install it gathered SSH keys, AWS, Azure, and GCP credentials, and the auth files belonging to Claude Code, Cursor, and Codex, then sent them out. On a server running the LiteLLM proxy it also read the provider API keys pooled in the database.

The exposure window ran from 11:39 to 13:23 UTC on PyPI and from 11:46 to 14:20 UTC on Docker Hub. Every user worldwide faced the same conditions regardless of region, and private enterprise registries were not affected. The safe version is 1.106.2. How the attacker got around the release process LiteLLM locked down after its March incident, and why the GitHub token that made it possible was sitting in LiteLLM's own logs, is covered in a separate post.

If your team runs the proxy from the latest tag with automatic image refresh, start with the image digest of the running container. If it restarted inside that window, rotating the provider keys stored in the proxy database comes first.

3. OpenAI shut off the o4-mini and GPT-3.5 APIs

On October 23 OpenAI shut off API access to o4-mini, o3-mini, o1, gpt-3.5-turbo, gpt-4, and gpt-image-1, along with fine-tunes of those models, exactly as its deprecations page said it would. Retired models are not rerouted to anything else. During the first round of shutoffs in July the names stayed in the /v1/models listing while calls returned errors, so code that checks liveness by listing models will not catch this.

This hits developers calling the OpenAI API directly and nobody using ChatGPT in the browser. Every replacement is callable from anywhere with an API key, with no region gate, but Azure OpenAI runs its own retirement schedule. Why the cheapest models get more expensive if you follow the official replacement table, and why GPT-6 Luna, which is absent from that table, costs less, is covered in a separate post. Moving gpt-3.5-turbo to its official replacement GPT-5.6 Terra takes output from $1.50 to $12 per million tokens, eight times the price.

Grep your repositories and deploy configs for retired model IDs today. Where you find one, run about 50 of your usual inputs through both the official replacement and GPT-6 Luna, then pick on quality and cost per request side by side.

4. Kimi K3.1 Pro landed 0.7 points behind Opus 5.5

Moonshot AI, based in China, released Kimi K3.1 Pro on October 23. It scored 65.7% on Terminal-Bench 4.0, the agentic coding test, against 66.4% for Claude Opus 5.5, a gap of 0.7 points. The API costs $2 per million input tokens and $10 per million output, half of Opus 5.5 at $4 and $20. K3, which shipped in July, was $3 and $15, so the price dropped 33% while the score went up. Moonshot said the full weights would be published by November 4.

Moonshot also wrote that it had found and removed cyberattack training data from the shipping build. The checkpoint without that removal solved 90.5% of its internal attack test and the shipping build solves 81.0%, still far above the 33.3% of its predecessor K3. How the scores, the price, and the weights commitment line up against China's draft export controls is covered in a separate post.

No country restriction appears in Moonshot's documentation, and the API docs are published in English. Developers do have to top up at least $1 at platform.kimi.ai before the model unlocks; the same prices are listed on OpenRouter if you would rather not open a Moonshot account. If your team runs Claude Code on an API key, re-run three or four of this week's real issues through K3.1 Pro, and put the output token counts from your bill next to Opus 5.5 rather than only the results. That is the only way to see what half the unit price is actually worth.

5. The new Claude API version drops temperature

Anthropic published API version 2026-10-21 on October 21, the first new version since June 2023. The change that bites hardest is the removal of temperature, top_p, and top_k, the parameters that controlled how consistent the output was. Until now you could send those values to flatten the variance in responses. In the new version, sending even the default value returns a 400 error.

The migration document states flatly that there is no replacement setting. Models after Claude 4.7 only ever accepted the default, so nothing changes there, but a request that lowered temperature on a model like Sonnet 4.6, which did accept other values, loses that effect. The document gives two options: drop the parameter, or keep that one request on the old 2023-06-01 version.

There is no region or plan condition, and it is opt-in: it applies only when you change the anthropic-version header or bump an SDK major version. On Amazon Bedrock the new version works only with Claude 4.7 and later models. If you use an SDK, search your code for temperature before upgrading, and if a single request passes a non-default value, leave that request on the old version.

6. GitHub opened a package firewall that blocks npm installs

GitHub put its package firewall into public preview on October 20. Coding agents and CI send requests to this relay instead of hitting the npm registry directly, so packages get screened before they are pulled. Administrators can turn on blocking for known malicious packages, a severity threshold, versions missing SLSA attestation, versions that newly introduce an install script that earlier versions did not have, and a minimum age, which requires a package to have been published for a set period, three days by default, before installs are allowed.

That last control maps directly onto this week's LiteLLM incident. The malicious version was up for a little over two hours, which is exactly the window a minimum-age rule would have blocked installs through.

The audience is narrow. It covers GitHub Enterprise Cloud customers only, data residency environments included, and npm is the sole registry supported so far. It is free during the preview and moves to usage-based billing, like Actions, at general availability. The announcement names no country restriction. If you are on Enterprise Cloud, route a single CI branch through the firewall while the preview is free and watch for false positives. If you are not, the moment to revisit this is when the general availability pricing lands.

7. Claude Duet opened only to US Pro and Max subscribers on a waitlist

Anthropic opened Claude Duet as a research preview on October 21. It watches the work apps you connect on your behalf and speaks first when something needs handling. It sends a briefing every morning, and because the tasks you hand it run in a cloud virtual machine, work continues with your laptop shut. The underlying model is Claude Opus 5.5.

It asks for approval before sending a message, paying, signing, or deleting. Securities trades and transfers between accounts are blocked outright, approval or not.

It is not available outside the United States. The announcement page names the audience as Claude Pro and Max subscribers in the US and takes sign-ups through a waitlist, so an account in Singapore or anywhere else outside the US cannot join the preview yet. Team and Enterprise plans are not included either. During the preview there is no separate charge, and it draws on the usage limits of your existing plan, including the checks it runs in the background. The moment to revisit this is when Anthropic announces a rollout beyond the US, or Team and Enterprise support.

The short version

The biggest change this week is Agent Skills changing owners, from Anthropic to a Linux Foundation affiliate, with no joining requirement to keep using or contributing to the standard. Three things are doable today: move a skill you only run in Claude into another tool, check the image digest of any proxy you started from the LiteLLM latest tag, and grep your repositories for the OpenAI model IDs that went dark on October 23. Kimi K3.1 Pro is callable today on a $1 top-up, or through OpenRouter at the same price, and the weights land November 4. Claude API 2026-10-21 means searching for temperature before you upgrade, and the GitHub package firewall is a general availability pricing question unless you are on Enterprise Cloud. Claude Duet is worth another look the day it leaves the US.