LLM fixes a bug that could send OpenAI keys to other providers

single source· 2 articles · confidence: medium · first seen 2026-11-02 23:49 UTC

What this means for you

If you use LLM against third-party OpenAI-compatible endpoints, upgrade to 0.37.2. The advisory does not say whether any key was actually transmitted, so how much exposure either path created is unknown; the patch closes both.

LLM, Simon Willison's command-line tool for sending prompts to different model providers, shipped version 0.37.2 on 11 November to fix a security issue reported by Daniel de Araujo in two GitHub advisories. A config file, extra-openai-models.yaml — managed since 0.37 by a new `llm openai endpoint add` command — points the tool at OpenAI-compatible endpoints run by other companies. The bug could send the configured OpenAI API key to one of them in two cases: the key named by api_key_name had never been stored, or a responses: true model was run with -o chat_completions 1. The note does not say whether a key was actually sent.

Key facts

  • ·Version 0.37.2 was released on 11 November 2026 to fix a security issue reported by Daniel de Araujo. source
  • ·The fix cites two GitHub security advisories: GHSA-v9h7-jj4g-f862 and GHSA-r639-rr7r-x72w. source
  • ·The `llm openai endpoint add` command, which manages extra-openai-models.yaml, was introduced in version 0.37. source
  • ·One exposure path was a key named by api_key_name that had never been stored; the other was a responses: true model run with -o chat_completions 1. source
  • ·The earlier 0.37 release post is dated 2 November 2026. source

What the sources say

  • Simon Willison — The earlier release post, dated 2 November, which arrives with no body text in the feed.
  • Simon Willison — Sets out the two code paths that could leak a stored key, and the advisory identifiers.

Sources

The original reporting. Follow these — they did the work.

← the wire