282 iOS AI Apps Leak API Keys and Open AI Proxy Access in Network Traffic Study

Summary: Wake Forest University researchers tested 444 AI chatbot apps for iPhone and found 282, nearly two-thirds, exposed paid AI access through their network traffic via plaintext API keys, reusable tokens, or backend servers that accepted requests with no key at all. Three months after notifying all 282 developers, only 28% had clearly fixed the issue, 23% were still wide open, and the leaks spanned at least ten AI providers and 13 app categories.
What you should know: Stolen keys feed LLMjacking, and Sysdig calculated a worst-case scenario of more than $46,000 a day in AI charges run on someone else's account - while one app's access token was set to expire in the year 2125 and another's one-hour token still worked 128 days after expiry.

Read the original at The Hacker News ↗