NewTrusted App · API Keys282 iOS AI apps leaked the keys to their AI model accounts
At a glance
- Apps tested
- 444 iOS AI apps
- Leaking
- 282 apps
- Still open
- 72% after 3 months
- Reported by
- Wake Forest University
What happened
Researchers analyzed 444 AI apps on iOS and found that 282 expose working credentials for large language model (LLM) services in their network traffic, across at least ten model providers. Anyone holding the credentials can send requests on the developer's account, and the developer pays.
Three months after the developers were told, 72% of the apps were still exploitable.
What was found
Most leaks came from replayable login tokens (48%), backends that accepted unauthenticated requests (33%) and API keys sent in plain text (19%). In some plain-text-key apps the same request also revealed the app's hidden system prompt. Neither the paper nor the press coverage names the apps or says user chats were exposed.
Data at risk
- LLM API keys
- Login tokens
- Hidden system prompts
- Developer AI bills
What you should do
- There is no setting that fixes this on your side; each app's developer has to.
- Avoid entering sensitive content in AI apps you do not know well.
- Developers: keep keys out of the app, check callers on your own server, and avoid long-lived replayable tokens.
View original postarXiv · The Hacker NewsSource: arXiv