A firm can evaluate a model’s answers while the software connecting to it steals the credentials. Attackers compromised LiteLLM’s PyPI package and published malicious Docker images carrying a payload that steals credentials, secrets and environment variables (the model can pass its tests while the connection fails its own).

Kai Tanner’s filing today identifies both delivery routes. For the people approving an AI supplier and its connection inside a Hong Kong licensed firm, that puts a compromised software component directly into the approval decision. A satisfactory answer from the model establishes nothing about whether the application has kept its credentials.

So the SFC’s Intermediaries Division has an existing instrument that reaches this decision. Its November 12, 2024 circular on generative AI language models covers senior management responsibility, model risk, cybersecurity and data risk, and third-party provider risk. The supplier assessment reaches the software through which the firm uses the model.

Aya Nakamura’s filing today reports Uber’s rollout of ChatGPT Work to 30,000 employees. That supplies the scale of an enterprise adoption decision; the LiteLLM incident supplies a concrete failure in connection software. Neither report establishes that Uber used the compromised software.

For a licensed firm putting client-facing investment research into service, the regulatory consequence is specific. The SFC circular identifies that use as high risk and notifiable under the Securities and Futures (Licensing and Registration) (Information) Rules.