A different llm credential-policy flaw occurred when a custom Responses model set needs_key=None but an option caused a new Chat Completions delegate to be constructed without preserving that setting. The delegate selected the OpenAI credential even for a third-party API base. The specific delegation mode is -o chat_completions 1 with custom Responses…
Inspect the ClaimsCase · DiggingBeagle record
Delegated llm Responses requests could revive a forbidden OpenAI credential
A different llm credential-policy flaw occurred when a custom Responses model set needs_key=None but an option caused a new Chat Completions delegate to be constructed without preserving that setting. The delegate selected the OpenAI credential even for a third-party API base. The upstream test does not prove any real third-party token misuse or a compromise through the independent key-alias defect.
Scope
The specific delegation mode is -o chat_completions 1 with custom Responses behavior, and the affected versions are 0.32a2 through the versions before 0.37.2.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
research_demonstration setting with demonstrated status, based on the identified primary disclosure and its stated test or incident limits. The new Claim distinguishes source observations from hypothetical downstream effects. Impact band is unassigned because the scoped evidence does not justify a comparable quantitative score; no unobserved customer harm or loss is imputed. Remediation state: patch_available.
Assessed Nov 13, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-ENR243-028-DETAIL · CLM-R242-SIMON-LLM-RESPONSES-DELEGATION-LIMITS · CLM-R242-SIMON-LLM-RESPONSES-DELEGATION-MECHANISM · Simon Willison llm Responses delegate GHSA-r639-rr7r-x72w
At a glance
An agent or wrapper that converts one model interface into another must carry the caller and destination credential policy across that conversion, not just translate prompt and response shapes.
Read the implicationsThe upstream test does not prove any real third-party token misuse or a compromise through the independent key-alias defect.
Limits and uncertaintyFull account
A different llm credential-policy flaw occurred when a custom Responses model set needs_key=None but an option caused a new Chat Completions delegate to be constructed without preserving that setting. The delegate selected the OpenAI credential even for a third-party API base.
The specific delegation mode is -o chat_completions 1 with custom Responses behavior, and the affected versions are 0.32a2 through the versions before 0.37.2. An agent or wrapper that converts one model interface into another must carry the caller and destination credential policy across that conversion, not just translate prompt and response shapes.
The upstream test does not prove any real third-party token misuse or a compromise through the independent key-alias defect. Retest every model delegate with absent and explicit provider credentials and rotate a credential only when exposed request paths are verified.
Evidence reconciliation and effect boundary. The outer Responses client correctly intended not to use the OpenAI key, but the internally constructed Chat client restored its class default when the original credential policy was not propagated. The effective HTTP request, not the top-level configuration, determines whether a secret crossed the provider boundary. The bug requires a specific delegation option and is independent of the missing-alias fallback defect, although both were fixed in 0.37.2.
Mechanism and trust boundary
- 01
The specific delegation mode is -o chat_completions 1 with custom Responses behavior, and the affected versions are 0.32a2 through the versions before 0.37.2.
- 02
An agent or wrapper that converts one model interface into another must carry the caller and destination credential policy across that conversion, not just translate prompt and response shapes.
Claims & evidence
CLM-ENR243-028-DETAILIn the independent llm Responses delegation flaw, the chat_completions option built a Chat delegate without propagating needs_key=None, allowing the delegate to select an OpenAI key for a custom API base.supported
Basis: reported finding
- supportsSimon Willison llm Responses delegate GHSA-r639-rr7r-x72wprimary disclosure
GHSA-r639-rr7r-x72w, Summary and Details, _delegate_chat_kwargs and get_key
CLM-R242-SIMON-LLM-RESPONSES-DELEGATION-LIMITSThe upstream test does not prove any real third-party token misuse or a compromise through the independent key-alias defect.supported
Basis: reported finding
- supportsSimon Willison llm Responses delegate GHSA-r639-rr7r-x72wprimary disclosure
GHSA-r639-rr7r-x72w, needs_key inheritance and chat_completions delegate reproducer
CLM-R242-SIMON-LLM-RESPONSES-DELEGATION-MECHANISMA different llm credential-policy flaw occurred when a custom Responses model set needs_key=None but an option caused a new Chat Completions delegate to be constructed without preserving that setting. The delegate selected the OpenAI credential even for a third-party API base.supported
Basis: reported finding
- supportsSimon Willison llm Responses delegate GHSA-r639-rr7r-x72wprimary disclosure
GHSA-r639-rr7r-x72w, needs_key inheritance and chat_completions delegate reproducer
Implications
An agent or wrapper that converts one model interface into another must carry the caller and destination credential policy across that conversion, not just translate prompt and response shapes.
Controls and mitigations
- Retest every model delegate with absent and explicit provider credentials and rotate a credential only when exposed request paths are verified.
Unknowns and contradictions
- The upstream test does not prove any real third-party token misuse or a compromise through the independent key-alias defect.
Sources and citation
Material revision history
- Nov 13, 2026 · Published version · first publication · revision 244