Simon Willison's llm 0.32.1: Transitive Dependency Breakage in AI CLI Tooling — Supply-Chain Lessons and Hardening Guide

---
title: Installation of llm CLI or AI Tooling via Python Package Managers
id: 4b8e2c61-7a3f-4d9e-b2a1-9c5f6e8d0a12
status: experimental
description: Detects pip/pipx/uv installation of the llm CLI or related LLM client packages. Identifies shadow AI tooling entering the environment outside of software governance and flags unreviewed dependency resolution events.
references:
  - https://simonwillison.net/2026/Aug/21/llm/
  - https://github.com/simonw/llm/releases/tag/0.32.1
author: Security Arsenal
date: 2026/08/21
tags:
  - attack.execution
  - attack.t1059.006
logsource:
  category: process_creation
  product: windows
detection:
  selection_installer:
    Image|endswith:
      - '\pip.exe'
      - '\pipx.exe'
      - '\uv.exe'
      - '\python.exe'
      - '\python3.exe'
  selection_cmd:
    CommandLine|contains:
      - 'install llm'
      - 'install "llm'
      - 'llm=='
      - 'llm>='
  condition: selection_installer and selection_cmd
falsepositives:
  - Approved developer workstations with sanctioned AI tooling
  - Data science teams with governed package installation
level: medium
---
title: Python Package Manager Resolving Unpinned Dependencies at Runtime
id: 8f1d4a92-3c6b-4e7f-a5d2-1b9c8e7f6a34
status: experimental
description: Detects pip or pipx performing package installation without version pinning or hash verification on servers, indicating uncontrolled dependency resolution in environments where reproducibility and supply-chain integrity are required.
references:
  - https://simonwillison.net/2026/Aug/21/llm/
  - https://attack.mitre.org/techniques/T1195/002/
author: Security Arsenal
date: 2026/08/21
tags:
  - attack.initial_access
  - attack.t1195.002
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith:
      - '/pip'
      - '/pip3'
      - '/pipx'
      - '/uv'
  selection_install:
    CommandLine|contains:
      - ' install '
  filter_pinned:
    CommandLine|contains:
      - '=='
      - '--require-hashes'
      - '--hash='
      - '-r requirements'
      - '--constraints'
  filter_path:
    CurrentDirectory|contains:
      - '/opt/ci'
      - '/var/lib/jenkins'
      - '/home/runner'
  condition: selection_img and selection_install and not filter_pinned and not filter_path
falsepositives:
  - Developers ad hoc installing tools on sanctioned workstations
  - Managed configuration tooling (Ansible/SSM) performing approved installs
level: low

// Hunt 1: llm CLI execution and ad hoc Python AI package installs across the fleet
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where ProcessCommandLine has_any ("llm ", "install llm", "pipx install", "llm prompt", "llm chat")
    or FileName in~ ("llm.exe", "llm")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| order by TimeGenerated desc;

// Hunt 2: Python processes making network connections to model-provider APIs from non-approved hosts
let ApprovedAIEgressDevices = dynamic(["appserver01", "ml-workstation-04"]); // populate with sanctioned hosts
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteUrl has_any ("api.openai.com", "api.anthropic.com", "generativelanguage.googleapis.com")
| where InitiatingProcessFileName has_any ("python", "python3", "llm", "uv")
| where DeviceName !in~ (ApprovedAIEgressDevices)
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName, RemoteUrl
| order by ConnectionCount desc;

// Hunt 3 (Syslog ingestion for Linux): unpinned pip installs on servers
Syslog
| where TimeGenerated > ago(14d)
| where ProcessName has_any ("pip", "pip3", "pipx", "uv")
| where SyslogMessage has " install "
| where SyslogMessage !has_any ("==", "--require-hashes", "--hash", "requirements")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated desc;

-- Inventory llm CLI installs and their openai/httpx dependency versions
-- by parsing dist-info metadata in site-packages directories
LET distinfo = SELECT FullPath,
       parse_string_with_regex(
         string=FullPath,
         regex='(?i)(llm|openai|httpx)-([0-9][0-9a-zA-Z\.\-]*)\.dist-info$') AS Match
FROM glob(globs=[
  'C:/Users/*/AppData/**/site-packages/*.dist-info',
  'C:/**/Lib/site-packages/*.dist-info',
  '/usr/lib/python3*/site-packages/*.dist-info',
  '/usr/local/lib/python3*/**/site-packages/*.dist-info',
  '/home/*/.local/lib/python3*/site-packages/*.dist-info',
  '/home/*/.local/share/pipx/venvs/*/lib/python3*/site-packages/*.dist-info'
])

SELECT Match[1] AS Package,
       Match[2] AS Version,
       FullPath AS MetadataPath,
       if(condition=Match[1] =~ '(?i)openai' AND
            Version =~ '^[3-9]', then='FLOATING_OPENAI_3x_PRESENT') AS RiskFlag
FROM distinfo
WHERE Match
ORDER BY MetadataPath

#!/usr/bin/env bash
# Audit and remediate llm CLI installs affected by the openai>=3 / httpx transitive dependency breakage
# Reference: https://simonwillison.net/2026/Aug/21/llm/
set -euo pipefail

echo "=== llm supply-chain audit (0.32.1 transitive dependency fix) ==="

# 1. Locate llm installs (pipx, pip user, system)
for PY in python3 python; do
  if command -v "$PY" >/dev/null 2>&1; then
    echo "--- Inspecting environment: $($PY -c 'import sys; print(sys.executable)') ---"
    $PY - <<'EOF' || true
import importlib.metadata as md
for pkg in ("llm", "openai", "httpx"):
    try:
        print(f"{pkg}: {md.version(pkg)}")
    except md.PackageNotFoundError:
        print(f"{pkg}: NOT INSTALLED")
EOF
  fi
done

if command -v pipx >/dev/null 2>&1; then
  echo "--- pipx environments ---"
  pipx list --short 2>/dev/null | grep -i '^llm' || echo "llm not installed via pipx"
fi

# 2. Detect the broken state: llm < 0.32.1 alongside openai >= 3 (missing httpx)
BROKEN=$(python3 - <<'EOF' || echo "unknown"
import importlib.metadata as md
from packaging.version import Version
try:
    llm_v = Version(md.version("llm"))
    openai_v = Version(md.version("openai"))
    if llm_v < Version("0.32.1") and openai_v >= Version("3.0.0"):
        print("BROKEN")
    else:
        print("OK")
except md.PackageNotFoundError:
    print("OK")
EOF
)

echo "Status: $BROKEN"

# 3. Remediate: upgrade to fixed release, or pin openai<3 for older installs
if [ "$BROKEN" = "BROKEN" ]; then
  echo "[!] Broken dependency state detected. Remediating..."
  if command -v pipx >/dev/null 2>&1 && pipx list --short 2>/dev/null | grep -qi '^llm'; then
    pipx upgrade llm
  else
    python3 -m pip install --upgrade "llm>=0.32.1"
  fi
  echo "[+] Remediated. Verifying:"
  python3 -c "import llm, httpx; print('llm', llm.__version__, '| httpx OK')"
fi

# 4. Hardness check: warn on any floating installs lacking pin/hash governance
echo "=== Governance check ==="
if ! ls requirements*.txt 2>/dev/null | xargs grep -l -- '--hash=' >/dev/null 2>&1; then
  echo "[WARN] No hash-pinned requirements files found in CWD."
  echo "       Enforce: pip install --require-hashes -r requirements.txt"
  echo "       Generate pinned deps with: pip-compile --generate-hashes"
fi
echo "=== Audit complete ==="