inference

Gheist Campaign Hits 850 GitHub Accounts Wiz reports Gheist secret theft across more than 13,500 branches and more than 850 compromised GitHub accounts. Also: Xinference model-loading and first-admin fixes, Unitree Go2 command injection, and Leon download path traversal. Reporting supplied by the operator; vulnerability disclosures are distinguished from observed campaign activity. 0:00 Gheist steals secrets through GitHub 1:08 Stolen tokens become secret-dumping workflows 3:03 The host-level collection attempt 4:37 Revoke tokens and rotate secrets 5:24 A model configuration can execute Python 6:48 Upgrade to 4.1.0 and review remote-code trust 7:59 An outsider can claim an empty installation 9:10 Setup tokens and account recovery 10:13 Remote command injection in robot chat 11:54 Model downloads can escape the models directory 13:23 Revoke, rotate, upgrade and check setup Sources Gheist steals secrets via GitHub Actions: wiz.io Xinference CosyVoice HyperPyYAML RCE: github.com/xorbitsai/inference/security/advisorie… Xinference first-run admin claim: github.com/xorbitsai/inference/security/advisorie… Unitree Go2 command injection in chat: nvd.nist.gov Leon AI path traversal in download: vulncheck.com CVEs mentioned: CVE-2026-115995, CVE-2026-116073. About this video: the host is an animated character and the narration is AI-generated speech. Scripts receive an editorial persona pass and automated narration checks. Avatar animation: Talking Head(?) Anime from a Single Image 3 by Pramook Khungurn (CC BY 4.0). #AI #ArtificialIntelligence #AISecurity #Wiz #GitHub #Anthropic #HuggingFace #Groq #NVIDIA #AWS #Amazon #Google #Microsoft #HashiCorp #IBM #Xinference #Xorbits #Unitree #Leon #VulnCheck

一行代码换模型：API 不动，GPT 切开源只改 base_url。昨天发过 ollama，它是装引擎那一层。 核心是多引擎编排：调度 𝐯𝐋𝐋𝐌、llama.cpp 等，LLM/语音/Embedding/多模态全接，4.0 加异构 P/D 与 auto batch。 局限：大而全，单机不如 ollama 快。 xorbitsai/inference t.co