Researchers who analyzed 444 AI chatbot applications for iOS discovered that 282 of them, roughly 63 percent, inadvertently exposed access to paid AI model infrastructure through their network traffic. The findings point to a systemic failure in how developers handle API credentials in mobile applications.

What the Researchers Found

The exposure took several forms. In a significant number of cases, apps transmitted API keys in plaintext, making them trivially recoverable by anyone monitoring the device’s outbound traffic. Other apps used reusable authentication tokens that could be extracted and replayed. In some instances, apps relied on backend proxy servers that accepted model requests with no authentication at all, meaning no credential was even needed to abuse the access.

The common thread across all three patterns is that any party able to observe an app’s network traffic, whether through a local proxy, a compromised Wi-Fi network, or simple traffic inspection on a test device, could obtain the means to submit requests to AI model APIs billed to the developer’s account.

Practical Impact

Once an API key or proxy endpoint is captured, an attacker can send arbitrary model requests charged to the original developer’s account. Depending on the pricing model and usage limits of the underlying AI service, this can translate directly into financial loss for the developer. It also raises data handling concerns, since an attacker controlling API access may be able to craft queries that probe the model or its surrounding infrastructure.

Root Cause

The underlying problem is a well-known mobile development antipattern: embedding server-side credentials in client applications or shipping apps that communicate with insufficiently protected backend services. AI app developers, many of whom are building consumer products quickly on top of third-party model APIs, appear to be reproducing this mistake at scale.

Recommendations

  • Never embed API keys directly in a mobile app binary or include them in network requests the client initiates.
  • Route all model API calls through a backend service that authenticates the end user before forwarding requests.
  • Apply rate limiting and usage monitoring on any proxy layer to detect and limit abuse even if credentials are compromised.
  • Rotate any key that has been present in a shipped app build, as it should be considered already compromised.

The scale of the findings suggests that developer education around secrets management has not kept pace with the rapid growth of AI-powered consumer app development.