llm-anthropic 0.31 Release: Securing Claude Fable 5.2 and Mythos 5.2 in Enterprise AI Pipelines

---
title: LLM CLI Tool Anthropic Key Configuration
description: Detects execution of llm CLI commands related to Anthropic API key configuration, which may indicate legitimate setup or potential credential exposure.
author: Security Arsenal
date: 2026/11/09
references:
  - https://simonwillison.net/2026/Nov/9/llm-anthropic/
  - https://attack.mitre.org/techniques/T1552/001/
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\llm.exe'
      - '\uv.exe'
  selection_cli:
    CommandLine|contains:
      - 'keys set anthropic'
      - 'llm install llm-anthropic'
      - 'claude-fable-5.2'
      - 'claude-mythos-5.2'
  condition: selection_img and selection_cli
falsepositives:
  - Legitimate developer activity
  - AI/ML engineering workflows
level: medium
---
title: Anthropic API Key File Access
description: Detects file access to LLM CLI configuration files containing Anthropic API keys, which may indicate credential harvesting attempts.
author: Security Arsenal
date: 2026/11/09
references:
  - https://attack.mitre.org/techniques/T1552/001/
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\.config\llm\keys.json'
      - '\llm\keys.json'
  selection_proc:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\python.exe'
  condition: selection_path and selection_proc
falsepositives:
  - Legitimate llm CLI operations
  - Backup software accessing config directories
level: high

// Hunt for llm CLI usage and Anthropic model invocations
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ ("llm.exe", "uv.exe", "python.exe")
| where ProcessCommandLine has_any (
    "keys set anthropic",
    "claude-fable-5.2",
    "claude-mythos-5.2",
    "llm-anthropic"
)
| project 
    TimeGenerated,
    DeviceName,
    InitiatingProcessAccountName,
    FileName,
    ProcessCommandLine,
    InitiatingProcessCommandLine,
    SHA256
| extend RiskIndicator = case(
    ProcessCommandLine has "keys set", "API Key Configuration",
    ProcessCommandLine has "fable-5.2", "New Model Usage",
    ProcessCommandLine has "mythos-5.2", "New Model Usage",
    "Installation"
)
| sort by TimeGenerated desc

-- Hunt for LLM CLI tool artifacts and Anthropic API key storage
SELECT 
    Pid,
    Name,
    CommandLine,
    Exe,
    Username,
    CreateTime,
    FileSize,
    Hash
FROM pslist()
WHERE CommandLine =~ 'llm.*(anthropic|fable|mythos)'
   OR CommandLine =~ 'uv tool install llm'
   OR Exe =~ 'llm\.exe$'

-- Check for key storage locations
SELECT 
    FullPath,
    Size,
    Mtime,
    Mode
FROM glob(
    globs=[
        'C:\\Users\\*\\.config\\llm\\keys.json',
        '/home/*/.config/llm/keys.json',
        '/root/.config/llm/keys.json'
    ]
)
WHERE Size > 0

#Requires -RunAsAdministrator
# LLM CLI Security Audit and Hardening Script
# Run this script to detect llm installations and secure API key storage

$AuditLog = @()

function Write-SecurityLog {
    param($Message, $Severity = "INFO")
    $LogEntry = "[$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')] [$Severity] $Message"
    $AuditLog += $LogEntry
    Write-Host $LogEntry
}

# Check for llm CLI installations
Write-SecurityLog "Scanning for llm CLI installations..."
$llmPaths = @(
    "$env:USERPROFILE\.local\bin\llm.exe",
    "$env:LOCALAPPDATA\Programs\llm\llm.exe",
    "$env:USERPROFILE\scoop\shims\llm.exe"
)

$llmInstalled = $false
foreach ($path in $llmPaths) {
    if (Test-Path $path) {
        Write-SecurityLog "Found llm installation at: $path" "WARNING"
        $llmInstalled = $true
        
        # Check for Anthropic plugin
        $pluginCheck = & $path plugins 2>$null | Select-String "anthropic"
        if ($pluginCheck) {
            Write-SecurityLog "llm-anthropic plugin detected" "WARNING"
        }
    }
}

# Audit API key storage locations
Write-SecurityLog "Checking for exposed API keys..."
$KeyPaths = @(
    "$env:USERPROFILE\.config\llm\keys.json",
    "$env:APPDATA\llm\keys.json"
)

foreach ($keyPath in $KeyPaths) {
    if (Test-Path $keyPath) {
        $FileInfo = Get-Item $keyPath
        $ACL = Get-Acl $keyPath
        
        Write-SecurityLog "API key file found: $keyPath" "CRITICAL"
        Write-SecurityLog "  Last Modified: $($FileInfo.LastWriteTime)"
        Write-SecurityLog "  File Size: $($FileInfo.Length) bytes"
        
        # Check permissions
        $AccessRules = $ACL.Access | Where-Object { $_.IdentityReference -notmatch "SYSTEM|Administrators|$env:USERNAME" }
        if ($AccessRules) {
            Write-SecurityLog "  WARNING: Excessive permissions detected on key file!" "CRITICAL"
            Write-SecurityLog "  Consider running: icacls '$keyPath' /inheritance:r /grant:r '$env:USERNAME:F'"
        }
        
        # Attempt to detect key format (safely)
        try {
            $KeyContent = Get-Content $keyPath -Raw | ConvertFrom-Json
            if ($KeyContent.anthropic) {
                Write-SecurityLog "  Anthropic API key detected in file" "CRITICAL"
                Write-SecurityLog "  Recommendation: Rotate this key immediately if system is not fully trusted"
            }
        } catch {
            Write-SecurityLog "  Could not parse key file (may be encrypted or corrupted)"
        }
    }
}

# Check for recent model usage in event logs (if audit logging enabled)
Write-SecurityLog "Checking for recent llm process execution..."
$RecentProcesses = Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4688; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue | 
    Where-Object { $_.Message -match "llm.*(anthropic|fable|mythos)" }

if ($RecentProcesses) {
    Write-SecurityLog "Found $($RecentProcesses.Count) recent llm process executions" "WARNING"
    foreach ($proc in $RecentProcesses | Select-Object -First 5) {
        Write-SecurityLog "  $($proc.TimeCreated): $($proc.Message.Substring(0, [Math]::Min(200, $proc.Message.Length)))"
    }
}

# Hardening recommendations
Write-SecurityLog "`n=== HARDENING RECOMMENDATIONS ===" "INFO"
Write-SecurityLog "1. Move API keys to environment variables or Azure Key Vault"
Write-SecurityLog "2. Implement Just-In-Time (JIT) access for Anthropic API keys"
Write-SecurityLog "3. Enable Anthropic API usage alerts for anomalous spending"
Write-SecurityLog "4. Restrict llm CLI execution to authorized developers via AppLocker"
Write-SecurityLog "5. Monitor for claude-fable-5.2 and claude-mythos-5.2 usage in proxy logs"

# Export audit log
$AuditLog | Out-File -FilePath "LLM_Security_Audit_$(Get-Date -Format 'yyyyMMdd_HHmmss').log"
Write-SecurityLog "Audit complete. Log saved to: LLM_Security_Audit_$(Get-Date -Format 'yyyyMMdd_HHmmss').log"