AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

datasette-llm-usage 0.2a0

infonewsLLM-Specific

industry

Source: Simon Willison's WeblogMarch 31, 2026

Summary

datasette-llm-usage version 0.2a0 removed features for tracking allowances and pricing, which moved to a separate tool called datasette-llm-accountant, and added the ability to log complete prompts, responses, and tool calls (automated functions the AI can call) to a database table if enabled through a configuration setting. The simple prompt page was redesigned and now requires specific user permissions to access.

Classification

Attack SophisticationTrivial

AI Component TargetedAPI

Affected Vendors

LangChain

Related Issues

critical

CVE-2024-27444: langchain_experimental (aka LangChain Experimental) in LangChain before 0.1.8 allows an attacker to bypass the CVE-2023-

Same vendorNVD/CVE Database

critical

CVE-2025-45150: Insecure permissions in LangChain-ChatGLM-Webui commit ef829 allows attackers to arbitrarily view and download sensitive

Same vendor

Monthly digest — independent AI security research

Original source: https://simonwillison.net/2026/Apr/1/datasette-llm-usage/#atom-everything

First tracked: April 1, 2026 at 02:00 AM

Classified by LLM (prompt v3) · confidence: 70%