In a nutshell: 282 iOS AI apps expose API keys and backend credentials unprotected over the network, enabling fraudulent use of paid services on third-party accounts.
More than two-thirds of 444 surveyed iOS chatbot apps leak LLM API keys in network traffic. Attackers can use these to access paid AI services without authentication.
Security researchers examined 444 AI chatbot applications for iPhone and identified 282 apps that expose paid AI access through their network traffic. This represents nearly two-thirds of the tested sample.
The exposure occurs in multiple ways: plaintext API keys are visible directly in network traffic, reusable tokens are transmitted unencrypted, or backend servers accept requests without any authentication. Simple network eavesdropping can thus reveal the credentials.
Anyone who captures such keys can submit AI requests under the developer account and thereby incur costs on a third party’s bill. For CISOs, this represents a significant risk when evaluating and deploying mobile AI applications in enterprise environments. API keys require minimal protection measures: secure storage (for example, through Keychain APIs on iOS), never hardcoded, and server-side authentication instead of direct client access to paid services.
Source: thehackernews.com · Published 30 June 2026
Lumi AI News — AI-assisted curation in accordance with Art. 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.2.