Skip to content
Hot eventWatching

LLM 0.37.2 fixes API key leak to third-party endpoints

1 reports1 reporting sourcesUpdated 2 d ago

Start here

AI digest

Simon Willison released LLM 0.37.2 to fix a security issue, reported by Daniel de Araujo in advisories GHSA-v9h7-jj4g-f862 and GHSA-r639-rr7r-x72w, that could send a configured OpenAI API key to third-party OpenAI-compatible endpoints. The leak occurred through the extra-openai-models.yaml mechanism in two cases: when the named api_key_name was never stored, or when a model with responses: true was run with the -o chat_completions 1 option. The release closes both paths.

Generated from reports · updated 21 h ago

LatestNovember 12 01:19
LLM 0.37.2 fixes API key leak to third-party OpenAI-compatible endpoints

Report timeline

Follow the reports to see the event from different sides.

November 12
  1. Simon Willison
    LLM 0.37.2 fixes API key leak to third-party OpenAI-compatible endpoints

    Simon Willison released LLM 0.37.2 to fix a security issue reported by Daniel de Araujo in GHSA-v9h7-jj4g-f862 and GHSA-r639-rr7r-x72w. The bug could send a configured OpenAI API key to third-party OpenAI-compatible endpoints via extra-openai-models.yaml if the named api_key_name was never stored, or if a responses: true model ran with -o chat_completions 1.

Heat for this event

Not enough continuous observations yet to draw a trend.