Simon Willison's Weblog·· 4 天前AI 评分48
LLM 0.37.2 发布，修复 OpenAI API Key 泄露安全问题
llm 0.37.2
AI 导读
LLM 0.37.2 发布，修复了可能导致用户配置的 OpenAI API Key 意外发送给第三方提供商的安全漏洞。该漏洞由 Daniel de Araujo 报告，涉及用于接入其他兼容端点的 extra-openai-models.yaml 机制。
正文 · 原文
Fixes a security issue reported by Daniel de Araujo in GHSA-v9h7-jj4g-f862 and GHSA-r639-rr7r-x72w.
LLM has a mechanism called extra-openai-models.yaml - now managed by the new-in-0.37 llm openai endpoint add command - for using LLM with OpenAI-compatible API endpoints from other providers.
Daniel reported two ways this could accidentally send your configured OpenAI API key to one of those providers: if the key named by api_key_name had never been stored, or if a responses: true model was run with -o chat_completions 1.
来源：Simon Willison's Weblog · simonwillison.net
EVAOO 主站实战落地 · AI Agent 与研发提效