llm 0.37.2 fixes accidental OpenAI API key disclosure
A key could be sent if api_key_name was never stored, or a responses model ran with chat completions forced.
4 stories, newest first · one card per story
A key could be sent if api_key_name was never stored, or a responses model ran with chat completions forced.

An unverified dark-web listing offers a claimed VirusTotal Enterprise API key for $350 in Bitcoin or Litecoin.

Attackers used a stolen Ribon BigCommerce app key to access Master of Malt customer contact data.

Threat actors stole an API key from AI evaluator METR and consumed $600,000 in public model credits; a second campaign probed its infrastructure.
Today 1.5K readers · 2.4K views · 754 reads · all time 189K views