LLM 0.37.2 Released: Securing Simon Willison's AI CLI Tool Against Prompt Injection and Supply Chain Risks

---
title: LLM CLI Tool Execution with Suspicious Arguments
id: 8f4a2c91-3b7e-4d9a-b5c2-9e1f6a8d4c3b
status: experimental
description: Detects execution of the llm CLI tool with arguments indicative of prompt injection attempts or unauthorized plugin installation
references:
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1195/
author: Security Arsenal
date: 2026/11/11
tags:
  - attack.execution
  - attack.t1059
  - attack.supply_chain
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\llm.exe'
      - '\python.exe'
    CommandLine|contains:
      - 'llm '
      - 'install'
      - 'plugin'
      - '--system'
      - 'exec'
  filter_known_good:
    CommandLine|contains:
      - 'llm --version'
      - 'llm models'
      - 'llm plugins'
  condition: selection and not filter_known_good
falsepositives:
  - Legitimate plugin installation by developers
  - Standard llm CLI usage in development environments
level: medium
---
title: Python Process Spawning System Shell via LLM Tool
id: 2c8e5f1a-9d4b-4e7a-a3c6-8f2b1d5e9a7c
status: experimental
description: Identifies Python processes (potentially running llm) spawning system shells or command interpreters, which may indicate successful prompt injection leading to command execution
references:
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1203/
author: Security Arsenal
date: 2026/11/11
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\python.exe'
      - '\llm.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\bash.exe'
      - '\sh.exe'
      - '\nc.exe'
      - '\netcat.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate use of llm plugins that require shell execution
  - Development workflows involving subprocess calls
level: high

// Hunt for llm CLI execution with suspicious parameters or plugin installations
let TimeRange = 24h;
union isfuzzy=true
    (SecurityEvent
    | where TimeGenerated > ago(TimeRange)
    | where EventID == 4688
    | where Process has "llm" or CommandLine has "llm"
    | where CommandLine has_any ("install", "plugin", "--system", "exec", "eval", "subprocess")
    | project TimeGenerated, Computer, Account, Process, CommandLine, ParentProcessName),
    (DeviceProcessEvents
    | where TimeGenerated > ago(TimeRange)
    | where FileName =~ "python.exe" or FileName =~ "llm.exe" or ProcessCommandLine contains "llm"
    | where ProcessCommandLine has_any ("install", "plugin", "--system", "exec")
    | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName)
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Count = count() by Computer, Account, CommandLine
| where Count > 5 or CommandLine has "plugin"
| order by LastSeen desc;

// Hunt for suspicious outbound connections from llm/python processes
DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where InitiatingProcessFileName =~ "python.exe" or InitiatingProcessFileName =~ "llm.exe"
| where RemoteUrl has_any ("pastebin", "github", "raw.githubusercontent", "pypi") or RemoteIPType == "Public"
| where not(RemoteUrl has_any ("openai", "anthropic", "azure", "google"))  // Exclude known API endpoints
| summarize ConnectionCount = count(), UniqueIPs = dcount(RemoteIP) by DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP
| where ConnectionCount > 10
| order by ConnectionCount desc;

-- Hunt for llm CLI installations and recent modifications indicating potential compromise
SELECT 
    Pid,
    Name,
    CommandLine,
    Exe,
    Username,
    CreateTime,
    Exe as BinaryPath
FROM pslist()
WHERE CommandLine =~ 'llm'
   OR Exe =~ 'llm'
   OR Name =~ 'python.*llm'

-- Check for recently modified llm plugins (potential malicious updates)
SELECT 
    FullPath,
    Size,
    Mtime,
    Atime,
    Ctime
FROM glob(globs='**/.config/llm/plugins/**', accessor='file')
WHERE Mtime > now() - 86400  // Modified in last 24 hours
   OR Ctime > now() - 86400
ORDER BY Mtime DESC

-- Hunt for suspicious network connections from Python processes (potential llm API abuse)
SELECT 
    Pid,
    Name,
    Path,
    LocalAddr,
    LocalPort,
    RemoteAddr,
    RemotePort,
    State
FROM netstat()
WHERE Name =~ 'python'
   AND State == 'ESTABLISHED'
   AND RemoteAddr !~ '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)'  // External IPs only

# Requires PowerShell 5.1 or later
# Run as Administrator for system-wide installations

Write-Host "=== LLM CLI Security Hardening Script ===" -ForegroundColor Cyan
Write-Host "Checking llm installation and version..." -ForegroundColor Yellow

# Check if llm is installed
try {
    $llmVersion = & llm --version 2>$null
    if ($llmVersion -match "0.37.2") {
        Write-Host "[OK] llm version 0.37.2 detected" -ForegroundColor Green
    } else {
        Write-Host "[WARNING] llm version $llmVersion detected - UPDATE REQUIRED" -ForegroundColor Red
        Write-Host "Updating llm to 0.37.2..." -ForegroundColor Yellow
        pip install --upgrade llm==0.37.2
    }
} catch {
    Write-Host "[INFO] llm not found in PATH. Checking pip installations..." -ForegroundColor Yellow
    $pipList = pip list | Select-String "llm"
    if ($pipList) {
        Write-Host "[WARNING] llm installed via pip but not in PATH or outdated" -ForegroundColor Red
        pip install --upgrade llm==0.37.2
    } else {
        Write-Host "[OK] llm not installed on this system" -ForegroundColor Green
    }
}

# Audit installed plugins
Write-Host "`n=== Auditing Installed Plugins ===" -ForegroundColor Cyan
$pluginPath = "$env:USERPROFILE\.config\llm\plugins"
if (Test-Path $pluginPath) {
    $plugins = Get-ChildItem -Path $pluginPath -Recurse -Filter "*.py" | Select-Object FullName, LastWriteTime
    foreach ($plugin in $plugins) {
        $hash = Get-FileHash -Path $plugin.FullName -Algorithm SHA256
        Write-Host "Plugin: $($plugin.FullName)" -ForegroundColor White
        Write-Host "  Last Modified: $($plugin.LastWriteTime)" -ForegroundColor Gray
        Write-Host "  SHA256: $($hash.Hash)" -ForegroundColor Gray
        
        # Check for recently modified plugins (potential supply chain attack)
        if ($plugin.LastWriteTime -gt (Get-Date).AddDays(-7)) {
            Write-Host "  [ALERT] Recently modified - verify legitimacy" -ForegroundColor Red
        }
    }
} else {
    Write-Host "No plugins directory found" -ForegroundColor Green
}

# Check for suspicious API key storage
Write-Host "`n=== Checking API Key Storage ===" -ForegroundColor Cyan
$keyPaths = @(
    "$env:USERPROFILE\.config\llm\keys.json",
    "$env:APPDATA\llm\keys.json"
)

foreach ($keyPath in $keyPaths) {
    if (Test-Path $keyPath) {
        $acl = Get-Acl $keyPath
        $accessRules = $acl.Access | Where-Object { $_.IdentityReference -notlike "*$env:USERNAME*" -and $_.IdentityReference -notlike "*SYSTEM*" -and $_.IdentityReference -notlike "*Administrators*" }
        
        if ($accessRules) {
            Write-Host "[WARNING] API key file accessible by unauthorized users: $keyPath" -ForegroundColor Red
            Write-Host "Restricting permissions..." -ForegroundColor Yellow
            icacls $keyPath /inheritance:r /grant:r "$env:USERNAME`(F`)" /grant:r "SYSTEM`(F`)" 2>$null
        } else {
            Write-Host "[OK] API key file permissions appear secure: $keyPath" -ForegroundColor Green
        }
        
        # Check if keys are base64 encoded (plaintext check)
        $content = Get-Content $keyPath -Raw
        if ($content -match '"sk-[a-zA-Z0-9]{48}"' -or $content -match '"sk-ant-[a-zA-Z0-9-]{95}"') {
            Write-Host "[CRITICAL] Plaintext API keys detected in $keyPath" -ForegroundColor Red
            Write-Host "Consider using environment variables or Azure Key Vault integration" -ForegroundColor Yellow
        }
    }
}

# Monitor for suspicious network activity
Write-Host "`n=== Network Security Recommendations ===" -ForegroundColor Cyan
Write-Host "1. Restrict outbound traffic from llm processes to known API endpoints only:" -ForegroundColor White
Write-Host "   - api.openai.com" -ForegroundColor Gray
Write-Host "   - api.anthropic.com" -ForegroundColor Gray
Write-Host "   - generativelanguage.googleapis.com" -ForegroundColor Gray
Write-Host "2. Block access to pypi.org from production systems running llm" -ForegroundColor White
Write-Host "3. Implement application whitelisting to prevent unauthorized llm plugin execution" -ForegroundColor White

Write-Host "`n=== Remediation Complete ===" -ForegroundColor Green