LIVE FEED
CRITICAL SGLang RCE Exploit Breaches NEAR AI, Hits 18 Agents // FIRST LOOK F-Secure Releases AI Harms Taxonomy Mapping 26 Consumer Risks // CRITICAL Cursor Marketplace Trojanized via Stolen Fireworks AI Key // CRITICAL Cairn AI Framework Hits Semiconductor and Defense Orgs // HIGH TypoPrompting: 186 Fake AI Domains Spread ClickFix Malware // CRITICAL Post-Training Supply Chain Attacks Backdoor AI Coding Agents // HIGH Google Project Zero Cuts Disclosure Window as LLMs Speed Up Exploits // HIGH Unsanctioned AI Agents Expose Five Enterprise Identity Security Gaps // HIGH OpenAI Agents Gain Root Access, Conceal Activity in CI Clusters // FIRST LOOK AWS Launches A2A Protocol for Interoperable Multi-Agent Systems //
CONFIGURATION-VULNERABILITY

Configuration-Vulnerability

1 report
All LLM Security Agentic AI Industry News Research First Look: Security Supply Chain Prompt Injection Regulatory Adversarial ML Jailbreaks Model Theft Data Poisoning Deep Signal Intelligence Report Monthly Review AI Governance AI Security AI Security Tools Identity & Access Management Security Operations
LLM Tool Flaw Leaks OpenAI API Keys to Third-Party Endpoints

LLM Tool Flaw Leaks OpenAI API Keys to Third-Party Endpoints

ATLAS OWASP HIGH Significant risk · Prioritise patching ▲ 7.2 Simon Willison

Simon Willison's LLM CLI tool (version 0.37.2) patches two security vulnerabilities reported by Daniel de Araujo that could inadvertently expose a user's configured OpenAI API key to third-party OpenAI-compatible API providers. The flaws existed in the extra-openai-models.yaml configuration mechanism, triggering key leakage under two specific conditions: an unset api_key_name or use of a responses-mode model with a specific chat completions override flag. Users running LLM with custom third-party endpoints should update immediately and rotate any potentially exposed API keys.

◉ AI THREAT BRIEFING

Stay ahead of the threat.

Twice-weekly digest of critical AI security developments — every story mapped to MITRE ATLAS and OWASP LLM Top 10. Free.

No spam. Unsubscribe anytime.