# How AI API Keys Leak From Mobile Apps, and How to Stop It > Source: > Published: 2026-10-18 14:52:25+00:00 *Dan Haiem, CEO of AppMakers USA, whose team builds AI features into iOS and Android apps, explains how these leaks happen and what a secure setup looks like.* Earlier this year, researchers at Wake Forest University tested 444 AI chatbot apps on the iPhone. Of those, 282 exposed paid AI access through their network traffic. That’s nearly two out of three. The attackers in this story don’t need to jailbreak a phone or reverse-engineer a binary. The researchers simply watched what the apps sent over the network and collected the credentials as they went by. Whoever grabs one can run AI requests on the developer’s account, and the developer pays the bill. The part that should worry founders most came next. The researchers warned all 282 developers and waited three months. Only 28% had clearly fixed the problem. I run a software agency that [builds AI features](https://appmakersla.com/services/artificial-intelligence/) into iOS and Android apps, including health and wellness apps. Health and fitness apps had the highest leak rate in that study, so this one hits close to home. Here’s how these leaks actually happen, and what a secure setup looks like. ## Why AI keys end up inside mobile apps No developer sets out to leak a key. It usually happens because the fastest path to a working demo is also the least secure one. - **Speed to launch.** Calling the AI provider straight from the app skips building a backend. For an MVP on a tight deadline, that shortcut is tempting. - **AI-generated code.** Coding assistants often produce examples that call the model directly from the client, with the key sitting in a config file. If nobody reviews it, that code ships. - **The demo becomes the product.** A prototype built to impress investors quietly turns into the version that goes to the App Store. - **A false sense of safety.** Many teams assume a compiled app hides its secrets. It doesn’t. Anything the app knows, a determined user can find. We see these patterns most often when we’re brought in to fix an app another team built. The fix is rarely hard. The problem is that nobody looked. ## The three ways AI access leaks The Wake Forest researchers sorted all 282 leaking apps into three groups. Each one maps to a common shortcut. | Leak pattern | Apps in the study | What’s happening | |---|---|---| | Replayable tokens | 136 | The app uses temporary tokens instead of the raw key, but the tokens leak in traffic and often stay valid far too long | | No key needed | 92 | The app routes requests through a server that answers anyone, with no check on who’s asking | | Plaintext keys | 54 | The real key travels in the open and can be read from a single captured request | **Replayable tokens** are the most common, and the most frustrating, because they’re the approach that’s supposed to be safer. Tokens only help if they expire quickly and are tied to a real user. In the study, one popular app set its token to expire in the year 2125. Another app’s one-hour token still worked 128 days later. **Open proxies** come from teams who did the right thing halfway. They moved the key to a server but never added authentication, so the server became a free relay to their paid AI account. **Plaintext keys** are the classic mistake. In 28 of the 54 plaintext-key apps, the same request also exposed the app’s hidden system prompt, the instructions that define how the product works. That’s a security leak and a competitive leak in one. ## What a stolen key actually costs Stolen AI credentials feed a practice called LLMjacking, where attackers use someone else’s keys to get free model access, then resell it or burn through it. Sysdig estimated a worst-case scenario in which stolen credentials could rack up more than $46,000 a day in AI charges. For a self-funded startup, a bill like that can end the company. But money isn’t the only cost. - **Your system prompt walks out the door.** Competitors can copy the instructions that make your product work. - **Your app becomes someone else’s tool.** An open proxy can be used to generate spam, scams, or abusive content under your account. - **Your provider may suspend you.** Abuse on your key can get your account flagged, taking your real users offline with it. - **Your users lose trust.** In health and wellness apps especially, a security story is hard to recover from. The research also shows that removing a key from the app isn’t enough. A larger audit found that developers often delete a leaked key from their code but never revoke it, so the old key keeps working. Exposed keys are not only a mobile problem either: see our coverage of the [Haruko breach that exposed 15 crypto funds’ API keys](https://shattered.io/haruko-cyberattack-15-crypto-funds-2026/). ## What a secure setup looks like The fix is old advice: the key never goes in the app. Here’s the architecture we use when we [build AI features for mobile apps](https://appmakersla.com/services/mobile-app-development/). 1. **Route every AI call through your own backend.** The app talks to your server. Only your server talks to OpenAI, Anthropic, Google, or whichever provider you use. The provider key lives in server-side secret storage, never in the app bundle. 2. **Authenticate every request.** Your backend should know which signed-in user is asking before it forwards anything. A proxy without auth is just a leaked key with extra steps. 3. **Keep tokens short-lived and user-bound.** If you issue tokens to the app, tie each one to a user session and let it expire in minutes, not years. 4. **Set rate limits and spending caps.** Limit requests per user and per minute. Set a hard monthly budget at the provider level so a leak can’t run unchecked. 5. **Watch for unusual usage.** Alert on sudden spikes, new regions, or one account making thousands of calls. Most leaks are obvious in the logs if someone is looking. 6. **Keep the system prompt on the server.** The app sends the user’s input. The backend adds the instructions. Your product logic stays private. 7. **Rotate and revoke.** Rotate keys on a schedule, and revoke any key that has ever shipped in a build, even if it’s been removed since. None of this is exotic. A basic authenticated proxy is a small amount of backend work, and it’s far cheaper than one bad billing cycle. ## A pre-launch checklist for AI features Before any app with an AI feature goes to the App Store or Google Play, run through these questions: - ☐ Can you find any provider key by searching the app bundle or config files? - ☐ Does every AI request go through a backend you control? - ☐ Does that backend reject requests without a valid signed-in user? - ☐ Do access tokens expire within minutes and tie to one user? - ☐ Is the system prompt stored only on the server? - ☐ Are per-user rate limits and a provider-level spending cap in place? - ☐ Will someone get an alert if usage suddenly spikes? - ☐ Have you revoked every key that ever appeared in a test or production build? The simplest test of all: install your own app, watch its network traffic with a free proxy tool, and see what you can grab. If you can pull a key or replay a request, so can anyone else. ## The AI rush didn’t create this problem Hardcoded secrets in mobile apps are an old mistake. What’s changed is the price of making it. A leaked email or analytics key used to be an embarrassment. A leaked AI key is a running meter on your account. The researchers note that their two-thirds figure is probably a floor, since many apps blocked interception entirely. As more founders ship AI features faster than ever, the teams that win will be the ones that treat the AI key like a bank password, not a config value. *Dan Haiem is the CEO of AppMakers USA, a custom software development agency that builds mobile and web apps for founders and enterprise clients.* ## Sources - [282 iOS AI Apps Leak API Keys and Open AI Proxy Access in Network Traffic Study](https://thehackernews.com/2026/06/282-ios-apps-found-leaking-llm-api-keys.html) , The Hacker News, June 30, 2026 (covers the Wake Forest study, the Sysdig LLMjacking estimate, and the Leaky Apps audit)