A Single Bad Package Exposed 2,500 Companies -- Gemini Hits a Billion Users as Claude Adds Watermarks

1) The Biggest AI Supply-Chain Breach of 2026

LiteLLM is a popular open-source library that lets developers call more than 100 different AI model APIs -- OpenAI, Anthropic, Gemini, and others -- through one unified interface. It sits quietly inside thousands of companies' AI agent stacks as plumbing. Attackers known as TeamPCP compromised Trivy, the security scanner running inside LiteLLM's own build pipeline, and used it to steal the project's PyPI publishing tokens. They pushed two poisoned versions (1.82.7 and 1.82.8) to PyPI. The malicious code lived inside a .pth file -- a file type Python automatically runs at startup -- so simply having the package installed was enough to trigger it, whether or not an application ever imported LiteLLM. It stole cloud credentials, SSH keys and Kubernetes tokens and sent them to a lookalike domain designed to pass a quick glance. Why it matters: the poisoned versions were live on PyPI for roughly 40 minutes, but automated CI/CD pipelines pull new dependency versions fast and unattended, so that short window was enough to reach more than 2,500 companies and an estimated 434,000 CI/CD pipelines, including NVIDIA, AWS, Cisco, Salesforce, Siemens and X Corp. The tool meant to keep a build pipeline safe became the way in -- a reminder that an AI stack is only as trustworthy as its least-audited dependency. In simple terms: imagine the security guard who checks every delivery entering a building was secretly handed a master key and quietly copied it for anyone who asked.

2) Gemini Crosses a Billion Users

Sundar Pichai announced on August 11 that the Gemini app has passed 1 billion monthly users -- Google's 14th product to reach that bar. About 63% of interactions happen by voice, and the app now generates more than 150 million images a day. That puts Gemini alongside ChatGPT (which crossed a billion monthly users in June) and Meta AI: three separate chat assistants now operating at the scale of the biggest social platforms in the world, simultaneously.

Why it matters: this connects directly to yesterday's story about the EU forcing Android open to rival assistants. Being the default AI on a billion devices isn't a nice-to-have anymore -- it's now worth roughly what owning a search engine or a social feed was worth a decade ago, which is exactly why regulators are starting to treat "default assistant" placement as a competition issue, not just a product choice.

3) Claude Starts Watermarking Every Word It Writes

The EU AI Act's Transparency Code (Article 50) took effect August 2, requiring AI companies to mark AI-generated content so other systems can identify it. Anthropic disclosed that every Claude model launched on or after that date now embeds an invisible statistical watermark in the text it generates, and is working to backport the same watermark to older models before the EU's grace period for pre-existing systems ends in December.

In simple terms: at almost every point while generating a sentence, a model has several equally good next-word choices. The watermark quietly nudges it to favor one arbitrary subset of those choices in a pattern only Anthropic's own detector knows how to read -- invisible to a human reader, but statistically detectable across enough text. It travels through copy-paste and survives some light editing. Why it matters: treat this as a compliance signal, not a slop-detector. Security researchers have pointed out that a single rewrite pass, paraphrase, or translation round-trip is enough to strip a text watermark, so it proves a company's own model touched the text at some point -- it doesn't reliably prove anything about text you receive from someone else.

4) Meta's Muse Glimmer Puts a Real Agent on Your Laptop

Meta released Muse Glimmer on August 10: a 30-billion-parameter, Apache 2.0 open-weight model built specifically for agent tasks -- scheduling, file management, tool-calling -- that runs entirely on a single 24GB consumer GPU at up to 20,000 tokens per second. On MCP Atlas, a benchmark for tool-calling and agent orchestration, it scores 75.5 against Gemma4-31B's 54.2 and Qwen3.6-27B's 62.5, despite needing no cloud infrastructure at all.

Why it matters: pair this with story 1. If agent execution moves off cloud APIs and onto local GPUs, that's fewer API keys sitting in CI pipelines and a smaller centralized attack surface -- but also less of a vendor watching what the agent actually does. A year ago, local-first agents were a hobbyist curiosity; now a frontier lab is explicitly optimizing a flagship release for it.