{"id":8977,"date":"2026-11-14T17:21:25","date_gmt":"2026-11-14T17:21:25","guid":{"rendered":"https:\/\/i10xnews.kinsta.cloud\/llm-0-37-2-openai-api-key-leak-third-party-endpoints"},"modified":"2026-11-14T17:21:25","modified_gmt":"2026-11-14T17:21:25","slug":"llm-0-37-2-openai-api-key-leak-third-party-endpoints","status":"publish","type":"post","link":"https:\/\/i10x.ai\/news\/llm-0-37-2-openai-api-key-leak-third-party-endpoints","title":{"rendered":"LLM 0.37.2 fixes OpenAI API key leak to third-party endpoints"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Simon Willison released LLM 0.37.2 on November 11, 2026 to fix two security advisories that caused the tool to send a user&#8217;s OpenAI API key to third-party endpoints. Daniel de Araujo reported both flaws, tracked as GHSA-v9h7-jj4g-f862 and GHSA-r639-rr7r-x72w. GitHub rates each one moderate, and neither carries a CVE.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u26a1 Quick Take<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>What:<\/strong> LLM sent OpenAI API keys to custom endpoints in two scenarios involving extra-openai-models.yaml configurations<\/li><li><strong>Who is affected:<\/strong> Users who defined custom OpenAI-compatible models with an api_base in extra-openai-models.yaml (versions 0.6\u20130.37.1 for the first flaw, 0.32a2\u20130.37.1 for the second)<\/li><li><strong>What to do:<\/strong> Upgrade to LLM 0.37.2 and rotate any OpenAI API key that was available while a custom api_base model was configured<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">In plain English<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">LLM is a command-line tool that lets developers talk to different AI language models. Two bugs meant that if you set up a custom model pointing to a third-party server, the tool would accidentally send your OpenAI password (called an API key) to that other server instead of the correct password. The other server&#8217;s operator could then see and use your OpenAI key. This only happened if you configured custom models in a specific way. If you only used the built-in OpenAI models, you were not affected. If you did set up custom models, you should update to version 0.37.2 and get a new OpenAI API key because the old one may have been sent to someone else&#8217;s server.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What happened<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Both flaws sit in how LLM decides which key to send when a model defined in extra-openai-models.yaml points at a custom api_base. In the first case, a model that sets api_key_name kept OPENAI_API_KEY as its key environment variable. When the named key had never been stored, the tool fell back to the OpenAI key and sent it to the third-party endpoint instead of failing. In the second case, a model with responses: true run with the -o chat_completions 1 option built a delegate object that did not inherit needs_key, so the delegate used the stored or environment OpenAI key. In both cases nothing told the user the OpenAI key had been sent.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Only installations that define custom OpenAI-compatible models with an api_base in extra-openai-models.yaml are exposed. The first flaw affects LLM 0.6 through 0.37.1. The second affects 0.32a2 through 0.37.1. A typo in api_key_name, skipping llm keys set, or a fresh machine with only OPENAI_API_KEY exported is enough to trigger the first flaw.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What you should do<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Upgrade to LLM 0.37.2. Rotate any OpenAI API key that was available while a custom api_base model was configured, because that key may have reached the provider, proxy or gateway behind the endpoint with no visible error. Configurations that use only the built-in OpenAI models are safe, because the problem is the key chosen for a custom api_base endpoint.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What it means<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The advisories show that credential handling in multi-provider CLI tools requires explicit checks at every delegation point. In the first advisory, register_models set needs_key to the alias but left key_env_var pointing at OPENAI_API_KEY, so get_key fell back to the OpenAI environment variable. In the second, the delegate object created for the chat-completions path never inherited needs_key from the outer model and used its default value instead. Version 0.37.2 corrects both paths.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Sources<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><a href=\"https:\/\/theinjection.dev\/items\/llm-cli-openai-key-custom-endpoint-leak\/\" target=\"_blank\" rel=\"noreferrer noopener\">The Injection: LLM 0.37.2 article<\/a><\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"<p>LLM, Simon Willison&#8217;s command-line tool for language models, sent a user&#8217;s configured OpenAI API key to third-party endpoints in two separate cases. Daniel de Araujo reported both, and version 0.37.2 fixes them.<\/p>\n","protected":false},"author":2,"featured_media":8976,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"paper_title":"","paper_url":"","pdf_url":"","doi":"","arxiv_id":"","authors":"","institutions":"","paper_date":"","venue":"","peer_reviewed":false,"code_url":"","data_url":"","funding_coi":"","figure_license":"","paper_license":"","replication":"","study_models":"","study_sample":"","footnotes":"","_yoast_wpseo_primary_category":"65","_nx_sec_severity":"medium","_nx_sec_affected":"LLM 0.6\u20130.37.1 (first flaw), 0.32a2\u20130.37.1 (second flaw)","_nx_sec_status":"patch-available","_nx_sec_kicker":"ALERT: CLI tool leaked OpenAI keys to third-party servers","_nx_sec_type":"coding","_nx_sec_vendor":"Simon Willison","_nx_sec_fixed":"0.37.2","_nx_sec_action":""},"categories":[65,22,12,28],"tags":[],"companies":[],"products":[],"class_list":["post-8977","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ai-security","category-coding","category-policy-safety","category-security-defense"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>LLM 0.37.2 fixes OpenAI API key leak to endpoints<\/title>\n<meta name=\"description\" content=\"LLM 0.37.2 patches two flaws that sent OpenAI API key to third-party endpoints when custom models used api_base. Rotate keys if affected.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/i10xnews.kinsta.cloud\/llm-0-37-2-openai-api-key-leak-third-party-endpoints\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"LLM 0.37.2 fixes OpenAI API key leak to endpoints\" \/>\n<meta property=\"og:description\" content=\"LLM 0.37.2 patches two flaws that sent OpenAI API key to third-party endpoints when custom models used api_base. Rotate keys if affected.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/i10xnews.kinsta.cloud\/llm-0-37-2-openai-api-key-leak-third-party-endpoints\" \/>\n<meta property=\"og:site_name\" content=\"i10X News\" \/>\n<meta property=\"article:published_time\" content=\"2026-11-14T17:21:25+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/11\/llm-0-37-2-openai-api-key-leak-third-party-endpoints-title.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1344\" \/>\n\t<meta property=\"og:image:height\" content=\"768\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Christopher Ort\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/i10x-news-og-default-1200x630-1.png\" \/>\n<meta name=\"twitter:creator\" content=\"@i10x_ai\" \/>\n<meta name=\"twitter:site\" content=\"@i10x_ai\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Christopher Ort\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"NewsArticle\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/llm-0-37-2-openai-api-key-leak-third-party-endpoints#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/llm-0-37-2-openai-api-key-leak-third-party-endpoints\"},\"author\":{\"name\":\"Christopher Ort\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/person\\\/d410bb7ee72febefca2c9c369939219a\"},\"headline\":\"LLM 0.37.2 fixes OpenAI API key leak to third-party endpoints\",\"datePublished\":\"2026-11-14T17:21:25+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/llm-0-37-2-openai-api-key-leak-third-party-endpoints\"},\"wordCount\":576,\"publisher\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/llm-0-37-2-openai-api-key-leak-third-party-endpoints#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/llm-0-37-2-openai-api-key-leak-third-party-endpoints-title.webp\",\"articleSection\":[\"AI Security\",\"Coding\",\"Policy &amp; Safety\",\"Security &amp; Defense\"],\"inLanguage\":\"en-US\",\"dateModified\":\"2026-11-14T17:21:25+00:00\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/llm-0-37-2-openai-api-key-leak-third-party-endpoints\",\"url\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/llm-0-37-2-openai-api-key-leak-third-party-endpoints\",\"name\":\"LLM 0.37.2 fixes OpenAI API key leak to endpoints\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/llm-0-37-2-openai-api-key-leak-third-party-endpoints#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/llm-0-37-2-openai-api-key-leak-third-party-endpoints#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/llm-0-37-2-openai-api-key-leak-third-party-endpoints-title.webp\",\"datePublished\":\"2026-11-14T17:21:25+00:00\",\"description\":\"LLM 0.37.2 patches two flaws that sent OpenAI API key to third-party endpoints when custom models used api_base. Rotate keys if affected.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/llm-0-37-2-openai-api-key-leak-third-party-endpoints#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/llm-0-37-2-openai-api-key-leak-third-party-endpoints\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/llm-0-37-2-openai-api-key-leak-third-party-endpoints#primaryimage\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/llm-0-37-2-openai-api-key-leak-third-party-endpoints-title.webp\",\"contentUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/llm-0-37-2-openai-api-key-leak-third-party-endpoints-title.webp\",\"width\":1344,\"height\":768,\"caption\":\"Image: AI-generated, i10X\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/llm-0-37-2-openai-api-key-leak-third-party-endpoints#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/i10x.ai\\\/news\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"LLM 0.37.2 fixes OpenAI API key leak to third-party endpoints\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#website\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\",\"name\":\"i10X News\",\"description\":\"Stay updated with the latest news and announcements from i10X.\",\"publisher\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/i10x.ai\\\/news?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\",\"name\":\"i10X\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/i10x-logo-180.png\",\"contentUrl\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/i10x-logo-180.png\",\"width\":180,\"height\":180,\"caption\":\"i10X\"},\"image\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/i10x_ai\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/i10x-ai\",\"https:\\\/\\\/instagram.com\\\/i10x.ai\",\"https:\\\/\\\/www.youtube.com\\\/@i10X_ai_official\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/person\\\/d410bb7ee72febefca2c9c369939219a\",\"name\":\"Christopher Ort\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"contentUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"caption\":\"Christopher Ort\"},\"description\":\"Christopher Ort handles SEO, AI agent workflows and PR & partnerships at i10x.ai, the all-in-one AI workspace built by i10X Global Pte. Ltd. in Singapore. He is a graduate of Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU). He is the author of \u201cThe Style Penalty\u201d, a study published on SSRN that analyses 1,576 evaluation decisions by four frontier AI models to show how AI-written CVs fare in automated hiring screens; the research has been covered by heise online and t3n.\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/author\\\/christopher-ort\",\"sameAs\":[\"https:\\\/\\\/i10x.ai\\\/blog\\\/author\\\/christopher-ort\"],\"worksFor\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"alumniOf\":{\"@type\":\"EducationalOrganization\",\"name\":\"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU)\",\"url\":\"https:\\\/\\\/www.fau.eu\"},\"subjectOf\":[{\"@type\":\"CreativeWork\",\"url\":\"https:\\\/\\\/papers.ssrn.com\\\/abstract=7426699\",\"name\":\"The Style Penalty: How AI Resume-Writing Tools Shape Outcomes in Automated Hiring Screens\"},{\"@type\":\"CreativeWork\",\"url\":\"https:\\\/\\\/www.heise.de\\\/news\\\/KI-Chatbots-bewerten-KI-Lebenslaeufe-Claude-findet-sich-besser-als-GPT-11317531.html\",\"name\":\"KI-Chatbots bewerten KI-Lebensl\u00e4ufe: Claude findet sich besser als GPT\"},{\"@type\":\"CreativeWork\",\"url\":\"https:\\\/\\\/t3n.de\\\/news\\\/bewerbung-schreiben-ki-5-fehler-1747190\\\/\",\"name\":\"Bewerbung mit KI schreiben: Diese 5 Fehler solltet ihr laut Studien vermeiden\"}]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"LLM 0.37.2 fixes OpenAI API key leak to endpoints","description":"LLM 0.37.2 patches two flaws that sent OpenAI API key to third-party endpoints when custom models used api_base. Rotate keys if affected.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/i10xnews.kinsta.cloud\/llm-0-37-2-openai-api-key-leak-third-party-endpoints","og_locale":"en_US","og_type":"article","og_title":"LLM 0.37.2 fixes OpenAI API key leak to endpoints","og_description":"LLM 0.37.2 patches two flaws that sent OpenAI API key to third-party endpoints when custom models used api_base. Rotate keys if affected.","og_url":"https:\/\/i10xnews.kinsta.cloud\/llm-0-37-2-openai-api-key-leak-third-party-endpoints","og_site_name":"i10X News","article_published_time":"2026-11-14T17:21:25+00:00","og_image":[{"width":1344,"height":768,"url":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/11\/llm-0-37-2-openai-api-key-leak-third-party-endpoints-title.webp","type":"image\/webp"}],"author":"Christopher Ort","twitter_card":"summary_large_image","twitter_image":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/i10x-news-og-default-1200x630-1.png","twitter_creator":"@i10x_ai","twitter_site":"@i10x_ai","twitter_misc":{"Written by":"Christopher Ort","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"NewsArticle","@id":"https:\/\/i10xnews.kinsta.cloud\/llm-0-37-2-openai-api-key-leak-third-party-endpoints#article","isPartOf":{"@id":"https:\/\/i10xnews.kinsta.cloud\/llm-0-37-2-openai-api-key-leak-third-party-endpoints"},"author":{"name":"Christopher Ort","@id":"https:\/\/i10x.ai\/news\/#\/schema\/person\/d410bb7ee72febefca2c9c369939219a"},"headline":"LLM 0.37.2 fixes OpenAI API key leak to third-party endpoints","datePublished":"2026-11-14T17:21:25+00:00","mainEntityOfPage":{"@id":"https:\/\/i10xnews.kinsta.cloud\/llm-0-37-2-openai-api-key-leak-third-party-endpoints"},"wordCount":576,"publisher":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"image":{"@id":"https:\/\/i10xnews.kinsta.cloud\/llm-0-37-2-openai-api-key-leak-third-party-endpoints#primaryimage"},"thumbnailUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/llm-0-37-2-openai-api-key-leak-third-party-endpoints-title.webp","articleSection":["AI Security","Coding","Policy &amp; Safety","Security &amp; Defense"],"inLanguage":"en-US","dateModified":"2026-11-14T17:21:25+00:00"},{"@type":"WebPage","@id":"https:\/\/i10xnews.kinsta.cloud\/llm-0-37-2-openai-api-key-leak-third-party-endpoints","url":"https:\/\/i10xnews.kinsta.cloud\/llm-0-37-2-openai-api-key-leak-third-party-endpoints","name":"LLM 0.37.2 fixes OpenAI API key leak to endpoints","isPartOf":{"@id":"https:\/\/i10x.ai\/news\/#website"},"primaryImageOfPage":{"@id":"https:\/\/i10xnews.kinsta.cloud\/llm-0-37-2-openai-api-key-leak-third-party-endpoints#primaryimage"},"image":{"@id":"https:\/\/i10xnews.kinsta.cloud\/llm-0-37-2-openai-api-key-leak-third-party-endpoints#primaryimage"},"thumbnailUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/llm-0-37-2-openai-api-key-leak-third-party-endpoints-title.webp","datePublished":"2026-11-14T17:21:25+00:00","description":"LLM 0.37.2 patches two flaws that sent OpenAI API key to third-party endpoints when custom models used api_base. Rotate keys if affected.","breadcrumb":{"@id":"https:\/\/i10xnews.kinsta.cloud\/llm-0-37-2-openai-api-key-leak-third-party-endpoints#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/i10xnews.kinsta.cloud\/llm-0-37-2-openai-api-key-leak-third-party-endpoints"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10xnews.kinsta.cloud\/llm-0-37-2-openai-api-key-leak-third-party-endpoints#primaryimage","url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/llm-0-37-2-openai-api-key-leak-third-party-endpoints-title.webp","contentUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/llm-0-37-2-openai-api-key-leak-third-party-endpoints-title.webp","width":1344,"height":768,"caption":"Image: AI-generated, i10X"},{"@type":"BreadcrumbList","@id":"https:\/\/i10xnews.kinsta.cloud\/llm-0-37-2-openai-api-key-leak-third-party-endpoints#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/i10x.ai\/news"},{"@type":"ListItem","position":2,"name":"LLM 0.37.2 fixes OpenAI API key leak to third-party endpoints"}]},{"@type":"WebSite","@id":"https:\/\/i10x.ai\/news\/#website","url":"https:\/\/i10x.ai\/news","name":"i10X News","description":"Stay updated with the latest news and announcements from i10X.","publisher":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/i10x.ai\/news?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/i10x.ai\/news\/#organization","name":"i10X","url":"https:\/\/i10x.ai\/news\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10x.ai\/news\/#\/schema\/logo\/image\/","url":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/i10x-logo-180.png","contentUrl":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/i10x-logo-180.png","width":180,"height":180,"caption":"i10X"},"image":{"@id":"https:\/\/i10x.ai\/news\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/i10x_ai","https:\/\/www.linkedin.com\/company\/i10x-ai","https:\/\/instagram.com\/i10x.ai","https:\/\/www.youtube.com\/@i10X_ai_official"]},{"@type":"Person","@id":"https:\/\/i10x.ai\/news\/#\/schema\/person\/d410bb7ee72febefca2c9c369939219a","name":"Christopher Ort","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","contentUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","caption":"Christopher Ort"},"description":"Christopher Ort handles SEO, AI agent workflows and PR & partnerships at i10x.ai, the all-in-one AI workspace built by i10X Global Pte. Ltd. in Singapore. He is a graduate of Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU). He is the author of \u201cThe Style Penalty\u201d, a study published on SSRN that analyses 1,576 evaluation decisions by four frontier AI models to show how AI-written CVs fare in automated hiring screens; the research has been covered by heise online and t3n.","url":"https:\/\/i10x.ai\/news\/author\/christopher-ort","sameAs":["https:\/\/i10x.ai\/blog\/author\/christopher-ort"],"worksFor":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"alumniOf":{"@type":"EducationalOrganization","name":"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU)","url":"https:\/\/www.fau.eu"},"subjectOf":[{"@type":"CreativeWork","url":"https:\/\/papers.ssrn.com\/abstract=7426699","name":"The Style Penalty: How AI Resume-Writing Tools Shape Outcomes in Automated Hiring Screens"},{"@type":"CreativeWork","url":"https:\/\/www.heise.de\/news\/KI-Chatbots-bewerten-KI-Lebenslaeufe-Claude-findet-sich-besser-als-GPT-11317531.html","name":"KI-Chatbots bewerten KI-Lebensl\u00e4ufe: Claude findet sich besser als GPT"},{"@type":"CreativeWork","url":"https:\/\/t3n.de\/news\/bewerbung-schreiben-ki-5-fehler-1747190\/","name":"Bewerbung mit KI schreiben: Diese 5 Fehler solltet ihr laut Studien vermeiden"}]}]}},"_links":{"self":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/8977","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/comments?post=8977"}],"version-history":[{"count":0,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/8977\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/media\/8976"}],"wp:attachment":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/media?parent=8977"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/categories?post=8977"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/tags?post=8977"},{"taxonomy":"company","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/companies?post=8977"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/products?post=8977"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}