Evidence · DiggingBeagle record
Simon Willison llm Responses delegate GHSA-r639-rr7r-x72w
Primary or origin disclosure used to qualify the underlying mechanism, stated prerequisites and limits. GHSA-r639-rr7r-x72w: custom Responses model with needs_key=None normally uses dummy; option -o chat_completions 1 creates new Chat delegate without copying needs_key, defaults to openai key from stored config/env; leaks to third-party api_base.
- Source role
- primary disclosure
Evidence record
Primary or origin disclosure used to qualify the underlying mechanism, stated prerequisites and limits. GHSA-r639-rr7r-x72w: custom Responses model with needs_key=None normally uses dummy; option -o chat_completions 1 creates new Chat delegate without copying needs_key, defaults to openai key from stored config/env; leaks to third-party api_base.
Claim-level citations (3)
- supportsDelegated llm Responses requests could revive a forbidden OpenAI credential: In the independent llm Responses delegation flaw, the chat_completions option built a Chat delegate without propagating needs_key=None, allowing the delegate to select an OpenAI key for a custom API base.
GHSA-r639-rr7r-x72w, Summary and Details, _delegate_chat_kwargs and get_key
- supportsDelegated llm Responses requests could revive a forbidden OpenAI credential: The upstream test does not prove any real third-party token misuse or a compromise through the independent key-alias defect.
GHSA-r639-rr7r-x72w, needs_key inheritance and chat_completions delegate reproducer
- supportsDelegated llm Responses requests could revive a forbidden OpenAI credential: A different llm credential-policy flaw occurred when a custom Responses model set needs_key=None but an option caused a new Chat Completions delegate to be constructed without preserving that setting. The delegate selected the OpenAI credential even for a third-party API base.
GHSA-r639-rr7r-x72w, needs_key inheritance and chat_completions delegate reproducer