llm 0.37.2 修复 API 密钥泄露的安全漏洞
llm 0.37.2
如果你在终端用 Simon Willison 的 llm 工具接第三方 OpenAI 兼容端点，这个版本必须升级，旧版可能把你自己的 OpenAI 密钥误发给别家。两个触发条件都写在报告里了，排查一下自己的配置只需几分钟。
Simon Willison 的开源命令行工具 llm 发布 0.37.2 版本，修复由 Daniel de Araujo 报告的两个安全问题（GHSA-v9h7-jj4g-f862 和 GHSA-r639-rr7r-x72w）。漏洞核心在于 extra-openai-models.yaml 机制，该机制用于让 llm 连接其他厂商的 OpenAI 兼容 API 端点，0.37 版本新增的 llm openai endpoint add 命令负责管理这项配置。
Daniel 报告了两种可能把用户配置的 OpenAI API 密钥误发给第三方提供商的场景：一是 api_key_name 指定的密钥从未被存储过，二是 responses: true 的模型在运行时带上 -o chat_completions 1 参数。两种情况下密钥都可能被意外发送到错误端点。
llm 是开发者常用的小型工具，可在终端直接调用各家模型 API，这类第三方端点配置在本地工具中并不少见，密钥发送目标错误属于典型的高风险配置问题。正在用 llm 连接 OpenAI 兼容端点的用户应尽快升级到 0.37.2。
llm 0.37.2
Release: llm 0.37.2 Fixes a security issue reported by Daniel de Araujo in GHSA-v9h7-jj4g-f862 and GHSA-r639-rr7r-x72w . LLM has a mechanism called extra-openai-models.yaml - now managed by the new-in-0.37 llm openai endpoint add command - for using LLM with OpenAI-compatible API endpoints from other providers. Daniel reported two ways this could accidentally send your configured OpenAI API key to one of those providers: if the key named by api_key_name had never been stored, or if a responses: true model was run with -o chat_completions 1 . Tags: projects , security , llm , releases
This report is categorized under AITOP's "Products" desk, focusing on US frontier AI labs and Silicon Valley technology leaders. Within our cross-regional analytical framework, it directly maps to AI developer toolchains, coding agents, and engineering workflows. Key entities and technical topics under continuous tracking include llm, Simon Willison, OpenAI, AI安全.
Source attribution: curated from Simon Willison’s Weblog. Cross-source corroboration: 11 independent sources have covered this development (including AWS Machine Learning Blog, Windsurf, 宝玉), confirming industry-wide signal strength.