datasette-llm 0.1a10: Restricting LLM Model Access — Detection and Hardening Guide

---
title: Datasette LLM Unauthorized Model Access Attempt
id: 7a3f1c82-9e4b-4d67-bc12-3e5a8f901234
status: experimental
description: Detects attempts to access LLM models not present in the configured allowlist via datasette-llm.
references:
  - https://github.com/datasette/datasette-llm/security/advisories
  - https://cwe.mitre.org/data/definitions/862.html
author: Security Arsenal
date: 2026/11/05
tags:
  - attack.privilege_escalation
  - attack.t1078
logsource:
  category: webserver
  product: linux
  service: datasette
detection:
  selection:
    cs-method: 'POST'
    cs-uri-path|contains:
      - '/-/llm'
      - '/llm'
    cs-body|contains:
      - 'model='
  filter:
    cs-body|contains:
      - 'model=gpt-4'
      - 'model=claude-3-opus'
      - 'model=default'
  condition: selection and not filter
falsepositives:
  - Legitimate administrative testing of new models before allowlist update
level: high
---
title: Datasette Configuration Modification Outside Change Window
id: 8b4e2d91-5f6a-4c8e-9d1a-2b3c4d5e6f7a
status: experimental
description: Detects modifications to datasette.yaml or environment variables outside approved change windows, potentially indicating persistence or tampering.
references:
  - https://attack.mitre.org/techniques/T1554/
author: Security Arsenal
date: 2026/11/05
tags:
  - attack.defense_evasion
  - attack.t1554
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|endswith:
      - 'datasette.yaml'
      - 'datasette.yml'
      - '.env'
  filter:
    Image|endswith:
      - '/git'
      - '/ansible'
      - '/puppet'
  condition: selection and not filter
falsepositives:
  - Legitimate configuration updates by administrators
level: medium

// Hunt for Datasette LLM model access outside allowlist
// Update the allowed_models dynamic list to match your configuration
let allowed_models = dynamic(["gpt-4", "claude-3-opus", "default"]);
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestURL contains "/-/llm" or RequestURL contains "/llm"
| extend ModelParam = extract(@"model=([^&\s]+)", 1, RequestURL)
| where isnotempty(ModelParam)
| where ModelParam !in (allowed_models)
| project TimeGenerated, SourceIP, RequestURL, ModelParam, RequestMethod, UserAgent
| order by TimeGenerated desc

-- Hunt for Datasette processes referencing unauthorized LLM models
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ 'datasette'
   AND CommandLine =~ 'model='
   AND NOT CommandLine =~ 'gpt-4|claude-3|default'

#!/bin/bash
# datasette-llm 0.1a10 Security Remediation Script
# Run with sudo privileges on Datasette hosts

set -e

REQUIRED_VERSION="0.1a10"
CONFIG_FILE="/etc/datasette/datasette.yaml"

# Check if datasette-llm is installed
if ! pip3 show datasette-llm &>/dev/null; then
    echo "[-] datasette-llm not found. Nothing to patch."
    exit 0
fi

CURRENT_VERSION=$(pip3 show datasette-llm | grep Version | awk '{print $2}')
echo "[*] Current datasette-llm version: $CURRENT_VERSION"

# Upgrade to patched version
echo "[*] Upgrading to $REQUIRED_VERSION..."
pip3 install --upgrade datasette-llm==$REQUIRED_VERSION

# Verify installation
NEW_VERSION=$(pip3 show datasette-llm | grep Version | awk '{print $2}')
if [[ "$NEW_VERSION" == "$REQUIRED_VERSION" ]]; then
    echo "[+] Successfully upgraded to $NEW_VERSION"
else
    echo "[-] Upgrade failed. Current version: $NEW_VERSION"
    exit 1
fi

# Validate configuration (ensure models are explicitly listed)
if [[ -f "$CONFIG_FILE" ]]; then
    echo "[*] Validating datasette.yaml..."
    python3 -c "import yaml; yaml.safe_load(open('$CONFIG_FILE'))" && echo "[+] Config syntax OK"
    
    # Check if models are restricted
    if grep -q "models:" "$CONFIG_FILE"; then
        echo "[+] Model restrictions found in config. Verify they match your allowlist."
    else
        echo "[!] WARNING: No 'models:' key found in datasette.yaml. All models may be exposed!"
    fi
else
    echo "[!] Config file not found at $CONFIG_FILE. Manual verification required."
fi

echo "[*] Remediation complete. Restart Datasette service to apply changes."

4. **Restart Service**: Ensure the Datasette process restarts to load the patched plugin.

**Long-Term Hardening:**
- Implement **network-level ACLs** restricting access to the LLM endpoint to authorized subnets.
- Enable **authentication** for Datasette (e.g., `datasette-auth-passwords` or OAuth) even for read-only instances.
- Monitor **cost anomalies** from LLM providers—unexpected spikes may indicate unauthorized model usage.
- Treat alpha software (0.x versions) as **high-risk** for production deployments; pin versions and monitor release notes aggressively.

---

## Related Resources

[Security Arsenal Penetration Testing Services](https://securityarsenal.com/services/penetration-testing)
[AlertMonitor Platform](https://securityarsenal.com/products/alertmonitor)
[Book a SOC Assessment](https://securityarsenal.com/contact)
[vulnerability-management Intel Hub](https://securityarsenal.com/intel/incident-response)