Simon Willison reported on 11 November 2026 that the LLM tool released version 0.37.2 to fix a security issue.reported The update resolves two vulnerabilities, identified as GHSA-v9h7-jj4g-f862 and GHSA-r639-rr7r-x72w, which were discovered by Daniel de Araujo.reportedThe LLM command-line tool has a new update that stops it from accidentally sending your secret keys to the wrong websites. These flaws involved the mechanism for using LLM with OpenAI-compatible API endpoints from providers other than OpenAI.
The figures
- Version 0.37.2 is the release that contains the fixes.reported
- Two specific CVE identifiers are cited: GHSA-v9h7-jj4g-f862 and GHSA-r639-rr7r-x72w.reported
- The feature management command, llm openai endpoint add, was introduced in version 0.37.reported
Behind the figures
Daniel de Araujo reported the security issues to the project maintainers.reported The vulnerabilities were documented in the release notes for version 0.37.2.reported The report details two specific scenarios where the tool could behave unexpectedly regarding API key handling when interacting with third-party endpoints.
What it means for your stack
Developers using the extra-openai-models.yaml file or the llm openai endpoint add command must upgrade to 0.37.2.reported Previous versions could inadvertently send your primary OpenAI API key to a different provider. This happened either because the expected key name was not stored or due to specific command-line flags used with responses-enabled models.
Building on this
Inference engineers can now use the llm openai endpoint add command with greater confidence when integrating third-party models. The documented capabilities include managing extra-openai-models.yaml for non-OpenAI providers. The limits previously involved accidental key leakage; the fix ensures that the configured OpenAI key stays with OpenAI unless explicitly intended otherwise for other endpoints.
Why it matters
- Inference engineers must patch immediately to prevent credential exposure to unauthorized third-party API endpoints.
- The fix clarifies the security boundary between OpenAI's native endpoints and compatible third-party services.
- Users of the llm openai endpoint add command introduced in 0.37 are directly affected by these two specific leakage paths.
- Daniel de Araujo's report highlights the risks of implicit key fallback behavior in multi-provider CLI tools.
Topics: llm, security, openai, api, cli
Updated
Then / now / next
LLM versions before 0.37.2 could leak OpenAI keys to third-party endpoints under specific configuration errors.
Version 0.37.2 fixes these two reported security issues to prevent accidental credential transmission.
Developers should monitor for further updates regarding the extra-openai-models.yaml configuration and endpoint management.
Story timeline
- Then LLM versions before 0.37.2 could leak OpenAI keys to third-party endpoints under specific configuration errors.
- 11 Nov 2026 llm 0.37.2
- Now Version 0.37.2 fixes these two reported security issues to prevent accidental credential transmission.
- Next Developers should monitor for further updates regarding the extra-openai-models.yaml configuration and endpoint management.
The strongest doubt
Counterpoint from the sources
The source material does not indicate whether these vulnerabilities were actively exploited in the wild before the patch.
Ask the article
Local keyword search of this article; no generated answers.Did this article give you the evidence you needed?
Your choice stays on this device. No public tally.Questions readers ask
Which versions of LLM are affected by this security issue?
Versions prior to 0.37.2 are affected, specifically those using the extra-openai-models feature or the endpoint add command from 0.37.
What triggers the accidental sending of the OpenAI API key?
The key is sent if the named api_key_name was never stored, or if a responses: true model runs with the -o chat_completions flag.
according to the published report, these vulnerabilities?
Daniel de Araujo reported the issues, which are tracked as GHSA-v9h7-jj4g-f862 and GHSA-r639-rr7r-x72w.
Connected stories
Reading receipt
- Version 0.37.2 addresses security issues GHSA-v9h7-jj4g-f862 and GHSA-r639-rr7r-x72w reported by Daniel de Araujo.
- The flaw allowed accidental transmission of configured OpenAI API keys to third-party OpenAI-compatible endpoints.
- Leaks occurred if the specified key name was missing or when running responses-enabled models with specific output flags.