LLM 0.37.2 fixes API key leak vulnerability
Understand this story
Simon Willison released LLM 0.37.2, fixing a security issue that could send OpenAI API keys to third-party endpoints. The issue was reported by Daniel de Araujo and corresponds to security advisories GHSA-v9h7-jj4g-f862 and GHSA-r639-rr7r-x72w. The report does not explain the vulnerability's trigger conditions, scope of impact, or whether existing keys need to be replaced; it only confirms that the new version contains the fix.
AI overview based on source reports · Updated 3 days ago
Coverage timeline
Follow the coverage to explore different perspectives.
- Simon Willisonllm 0.37.2
llm 0.37.2 fixes a security issue reported by Daniel de Araujo in GHSA-v9h7-jj4g-f862 and GHSA-r639-rr7r-x72w. The extra-openai-models.yaml mechanism, now managed by the new-in-0.37 `llm openai endpoint add` command, could accidentally send your configured OpenAI API key to another provider if the key named by api_key_name had never been stored, or if a `responses: true` model was run with `-o chat_completions 1`.
Activity for this story
- Current comparable activity
- 3
- Peak comparable activity
- 10Nov 12 03:00
- Change in the past 24 hours
- -50%
Trends compare the same fully observed participants, which may cover fewer participants than current activity. Move the pointer or tap the chart to inspect hourly activity; use the left and right arrow keys with a keyboard.