MediumNewsLLM-specific
llm 0.37.2
- Published
- Record updated
Summary
llm 0.37.2 fixes a security issue reported by Daniel de Araujo under GHSA-v9h7-jj4g-f862 and GHSA-r639-rr7r-x72w. The flaw could accidentally send a configured OpenAI API key to a third-party OpenAI-compatible endpoint configured through extra-openai-models.yaml or the llm openai endpoint add command. It could occur if the key named by api_key_name had never been stored, or if a responses: true model was run with -o chat_completions 1.
Mitigation
Fixed in llm 0.37.2.
Related items
- InfoEndor Labs + OpenAI: Strengthening the Defense Factory With Accelerated Remediation | Endor LabsSame vendor · Endor Labs Blog
- LowAI chatbots are recommending fake retail websites, study findsSame vendor · The Verge (AI)
- InfoImproving Fuzzy Robustness in LLM Safety with Automated Red TeamingSame vendor · OpenAI Alignment Research Blog
- MediumHackers stole AI credentials to get $740,000 in free compute; Railway picked up the billSame vendor · CSO Online
- InfoSupporting research on AI and children’s safetySame vendor · OpenAI Blog