{"slug": "llm-0-37-2", "title": "llm 0.37.2", "summary": "Simon Willison released llm 0.37.2, fixing a security issue reported by Daniel de Araujo in advisories GHSA-v9h7-jj4g-f862 and GHSA-r639-rr7r-x72w that could send a user's configured OpenAI API key to third-party OpenAI-compatible providers. The flaw affected the extra-openai-models.yaml mechanism, now managed by the llm openai endpoint add command introduced in 0.37, and triggered when the key named by api_key_name had never been stored or when a responses: true model was run with -o chat_completions 1.", "body_md": "**Release:** [llm 0.37.2](https://github.com/simonw/llm/releases/tag/0.37.2)\n\nFixes a security issue reported by [Daniel de Araujo](https://github.com/BluePlexus) in [GHSA-v9h7-jj4g-f862](https://github.com/simonw/llm/security/advisories/GHSA-v9h7-jj4g-f862) and [GHSA-r639-rr7r-x72w](https://github.com/simonw/llm/security/advisories/GHSA-r639-rr7r-x72w).\n\nLLM has a mechanism called [extra-openai-models.yaml](https://llm.datasette.io/en/stable/other-models.html#configure-an-openai-compatible-model) - now managed by the new-in-0.37 [llm openai endpoint add](https://llm.datasette.io/en/stable/other-models.html#openai-endpoint-add) command - for using LLM with OpenAI-compatible API endpoints from other providers.\n\nDaniel reported two ways this could accidentally send your configured OpenAI API key to one of those providers: if the key named by `api_key_name` had never been stored, or if a `responses: true` model was run with `-o chat_completions 1`.", "url": "https://wpnews.pro/news/llm-0-37-2", "canonical_source": "https://simonwillison.net/2026/Nov/11/llm/", "published_at": "2026-11-11 17:19:52+00:00", "updated_at": "2026-11-11 18:52:58.467346+00:00", "lang": "en", "topics": ["ai-tools", "developer-tools", "ai-safety"], "entities": ["llm", "Simon Willison", "Daniel de Araujo", "OpenAI", "GHSA-v9h7-jj4g-f862", "GHSA-r639-rr7r-x72w"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/llm-0-37-2", "markdown": "https://wpnews.pro/news/llm-0-37-2.md", "text": "https://wpnews.pro/news/llm-0-37-2.txt", "jsonld": "https://wpnews.pro/news/llm-0-37-2.jsonld"}}