A practical guide to auditing connected apps, rotating Claude and Codex API keys, and using AI itself to find exposed secrets after recent breaches.
Why are AI API keys suddenly worth stealing? #
Because tokens now behave like cash. If someone gets your Claude or Codex API key, they can run inference on your account, sell access to someone else, or burn through your usage quota, and you get the bill. A recent wave of incidents made this concrete: a popular tool for connecting apps to AI models shipped a release that stole developer credentials, a hosting provider shut down after a breach, and a founder pulled their own product offline after warnings that both AI and payment keys had been compromised. At the same time, AI agents are being used to scan old software for vulnerabilities at a scale no human security team could match, which means the exposure window for leaked keys is shrinking fast.
TL;DR #
- API keys are now liquid assets : a stolen Claude or Codex key lets an attacker run AI workloads on your account or resell access, and the cost lands on you.
- Supply chain tools are a weak point : an AI gateway tool called LiteLLM had a credential stealing malware incident in its October release, following an earlier compromise in March of the same year.
- Source code looking clean isn’t proof of safety : LiteLLM’s disclosure showed the official source tag was unaffected while the distributed package that people actually installed contained malicious files.
- Infrastructure-level bugs can cascade : a certificate authority, eMudhra, had private keys so weak that a researcher recovered them in under a second using Claude, and because of chain-of-trust rules, that one company’s mistake had internet-wide implications.
- AI-assisted vulnerability discovery is running at a scale previously unseen : Anthropic reported more than 29,000 candidate vulnerabilities surfaced from six months of scanning widely used software projects, with roughly 6,000 manually reviewed so far.
- Auditing your own connected apps is the single most actionable defense : reviewing what third-party apps can access in Google, GitHub, or similar account settings, and revoking what you don’t need, directly shrinks your attack surface.
- You can use AI itself to run the audit : giving a model the list of connected apps and their permissions and asking it to flag risky access is a fast, repeatable way to catch exposure before it’s exploited.
One coffee. One working app. #
You bring the idea. Remy manages the project.
What actually happened in this breach wave? #
The trigger event was a set of critical PHP vulnerabilities disclosed on October 21. PHP runs a large share of the web, including most WordPress sites, and the flaw allowed attackers to get code running on a website before the site’s own application code even started, effectively hijacking the platform underneath it. UK and European security agencies responded by telling organizations to consider isolating or taking down systems they couldn’t patch quickly, which is about as severe a public warning as governments issue for a software bug.
Separately, eMudhra, a certificate authority whose job is to issue the credentials that let browsers trust a website, was found to have private keys that were trivially weak. Researcher Scott Helme recovered eight of them, including one that was supposed to be an enormous random number but turned out to be the digit 4. Helme reportedly used Claude to recover the keys with a single prompt. Because eMudhra was a trusted root issuer, that single failure had the potential to cascade across every site relying on its certificates.
Major infrastructure players moved fast in response. Mozilla says it pushed protection into standard Firefox configurations within hours of the report. Cloudflare and Vercel, which sit in front of large portions of the web, rolled out protections that shield sites behind them even before individual site owners patch. Microsoft also disclosed that a China-aligned group used an AI agent framework (reported as Artek) to target hundreds of organizations, with some attacks reaching privileged cloud access within hours.
Why does this matter if you just use Claude or Codex personally? #
Because the same dynamic that lets attackers find infrastructure bugs faster also applies to the apps you’ve connected to your accounts. Every time you paste an API key into a third-party tool, or authorize an app to read your calendar, files, or email, you’re extending your attack surface to include that app’s hosting provider, its dependencies, and its own security practices, most of which you’ve never audited and never will.
LiteLLM, a widely used tool for connecting applications to AI model providers, illustrates this well. It has had multiple security incidents over the past year, including a compromise in March and a separate October disclosure describing a release that shipped with credential stealing malware. The important detail: LiteLLM’s own disclosure stated that the official source code tag was clean, but the distributed package that people actually installed was not. That means checking the public repository isn’t enough to confirm you’re safe. If you installed the affected release, the only safe assumption is that your environment was compromised, and the correct response is to follow containment steps and rotate every secret that passed through it.
How do you audit your connected apps and permissions? #
Other agents ship a demo. Remy ships an app. #
Real backend. Real database. Real auth. Real plumbing. Remy has it all.
Start with the accounts that touch the most sensitive data. Google is a good example: its account settings let you review every third-party app you’ve authorized and see exactly what it can do, read basic profile info, read files, or modify them. Go through that list and ask two questions for each entry: do I still use this, and does it need the access it has? Revoke anything you don’t recognize or no longer use. This is a basic security principle, reducing the attack surface, and it takes most people under twenty minutes.
Do the same for GitHub, Slack, and any service where you’ve issued API keys or OAuth tokens to third-party tools. If you’ve pasted a Claude or Codex API key into an app, check whether that app has had any security disclosures recently (as LiteLLM did) and rotate the key regardless of whether you find anything, since rotation is cheap and leaked keys are not.
Can AI itself help you find exposed keys and risky permissions? #
Yes, and this is one of the more useful applications of the same technology causing the problem. You can give an AI model, Claude, ChatGPT, or another model of your choice, the list of apps you’ve authorized along with their permission descriptions, and ask it to flag anything that looks unnecessary or risky given what the app actually does. The same reasoning ability that lets an agent dig through unfamiliar code to find a vulnerability can be pointed at your own settings to find where you’re overexposed.
A useful habit is to have the AI write down everything it checks as it goes, so you end up with a record of what was reviewed and when. That record becomes valuable later, because the next step isn’t a one-time audit. Given how frequently these disclosures are landing, treat the audit as something to rerun whenever a tool you use has a security incident, not as a task you complete once and forget.
Is rotating API keys actually necessary, or is auditing permissions enough? #
Auditing reduces your exposure going forward, but it doesn’t undo access that already happened. If a tool you used had a confirmed compromise (like LiteLLM’s October incident), the safe assumption is that any key that passed through it during the affected window is already burned. Rotating means generating a new key and invalidating the old one at the provider (Anthropic for Claude, OpenAI for Codex and other OpenAI models), then updating every place the old key was used. Skipping rotation because “nothing looks wrong yet” is the mistake that turns a contained incident into an ongoing one, since a stolen key can sit unused for weeks before someone monetizes it.
Frequently Asked Questions #
How do I know if my Claude or Codex API key has been exposed?
Check whether any tool you’ve connected the key to has published a security disclosure, and review your usage dashboard on the Anthropic or OpenAI console for unexpected spikes or unfamiliar activity. If you can’t rule it out with confidence, rotate the key regardless.
What’s the difference between auditing permissions and rotating keys?
Auditing permissions means reviewing what third-party apps are allowed to access and revoking what’s unnecessary, which reduces future risk. Rotating keys means replacing a credential that may already be compromised. Both matter, but rotation addresses access that may have already occurred.
Why did a clean source code repository not mean a tool was safe?
Seven tools to build an app. Or just Remy. #
Editor, preview, AI agents, deploy — all in one tab. Nothing to install.
In the LiteLLM case, the disclosure stated the official source tag was unaffected, but the distributed release package that users actually installed contained malicious files. Checking the public repo tells you about the code, not necessarily about what shipped in the installed package.
Should I avoid connecting AI tools to my accounts altogether?
That’s not realistic for most developers, since connected tools are how AI gets useful access to files, calendars, and code. The practical approach is to grant the minimum access needed, review connections periodically, and rotate credentials after any disclosure involving a tool you use.
How often should I re-run a security audit of my connected apps?
Given how frequently these disclosures are surfacing, treat it as an ongoing habit rather than a one-time task. Rerunning the check whenever a tool you depend on has a reported incident is a reasonable minimum.