282 iOS AI Apps Leak API Keys and Open AI Proxy Access in Network Traffic Study
15:49 · June 30, 2026 · Hacker News AI Section
Researchers tested 444 AI chatbot apps for iPhone and found that 282 of them, nearly two-thirds, exposed paid AI access through their network traffic. In many cases, the path in was visible just by watching what the app sent: a plaintext API key, a reusable token, or a backend server that accepted requests with no key at all. Whoever grabs it can send model requests on the developer's account,
Summary
Researchers at Wake Forest University examined 444 AI chatbot apps on the US iOS App Store and found that 282 of them exposed credentials or unsecured endpoints in network traffic. The exposures took three main forms: plaintext API keys sent with requests, long-lived reusable tokens, and backend servers that accepted model calls without authentication. In 28 of the 54 plaintext-key cases the same traffic also revealed the app’s hidden system prompt.
The leaked material allows any observer to issue requests against the developer’s account with the corresponding provider, most often OpenAI but also at least nine other services. The practice, sometimes called LLMjacking, shifts inference costs directly to the account holder; one industry estimate placed the daily exposure of a single high-value key above $46,000. The affected apps spanned thirteen categories, with productivity titles the largest group and health-and-fitness titles showing the highest leak rate. Finance and medical apps recorded none. Most were small, yet one carried more than two million user ratings.
Three months after the researchers notified the developers, only 28 percent had demonstrably removed the exposure. Another 23 percent remained fully open; the remainder had gone offline or returned errors. Several token-based apps used expiration dates measured in decades or retained working tokens long after their nominal expiry. The study relied on passive traffic inspection with a purpose-built tool, LLMKeyLens, and required neither device jailbreaking nor binary analysis.
The authors note that the observed two-thirds rate is a lower bound, because many apps blocked interception and the sample covered only one storefront at one point in time. They recommend that developers route all model calls through an authenticated server rather than embed keys on the client, and they urge providers and Apple to flag client-side keys during documentation and review. Earlier Android-focused audits have documented the same pattern, indicating that the problem is not confined to one platform.
Why it matters
Directly addresses AI security risks from leaked credentials, actionable for Dutch teams auditing or building AI apps. Relevant to EU GDPR and upcoming AI Act compliance needs for privacy and access control.
