LLM 0.37.2 repairs two conditions that send an OpenAI key in error

The tool LLM has a new version, 0.37.2. It repairs a problem that Daniel de Araujo reported. The person found two conditions in which LLM could send a configured OpenAI API key to a different provider in error. This is for users who use LLM with OpenAI-compatible endpoints from other providers. The release text gives no date, no severity rating and no count of users.

How it works

LLM can use endpoints from other providers that use the OpenAI interface. The name extra-openai-models.yaml is the configuration for them. The new command llm openai endpoint add in version 0.37 controls that configuration.

The two conditions

LLM could send the key to the other provider in these conditions:

• The key for api_key_name was not stored.
• A model with responses on ran with chat completions.

What is not known

The release text does not tell the changes that the repair makes. It does not tell if a person used the problem. It tells that the key send is accidental and gives no attack. It refers to two GitHub advisories. No test result is given.

Insight: Tools that connect many providers hold your keys

In October 2026, attackers put malware that steals cloud and AI keys in LiteLLM version 1.107.0, a different tool. In LLM the key goes out in error, with no attack. The key storage of a tool that connects many providers is where the value is, and each bug there can become a key leak. It reads as if attackers and bugs find the same target. Give each provider a different key.