LaunchDevelopersNovember 11, 2026

LLM 0.37.2 patches API key leak to third-party endpoints

Read original source →simonwillison.net

Version 0.37.2 fixes two flaws reported by Daniel de Araujo (GHSA-v9h7-jj4g-f862, GHSA-r639-rr7r-x72w) that could send a configured OpenAI API key to other providers via extra-openai-models.yaml. Triggers: an api_key_name never stored, or a responses: true model run with -o chat_completions 1.

1 source

More stories today

Open the live feed