Welcome to the forefront of conversational AI as we explore the fascinating world of AI chatbots in our dedicated blog series. Discover the latest advancements, applications, and strategies that propel the evolution of chatbot technology. From enhancing customer interactions to streamlining business processes, these articles delve into the innovative ways artificial intelligence is shaping the landscape of automated conversational agents. Whether you’re a business owner, developer, or simply intrigued by the future of interactive technology, join us on this journey to unravel the transformative power and endless possibilities of AI chatbots.
Researchers tested 444 AI chatbot apps for iPhone and found that 282 of them, nearly two-thirds, exposed paid AI access through their network traffic.
In many cases, the path in was visible just by watching what the app sent: a plaintext API key, a reusable token, or a backend server that accepted requests with no key at all.
Whoever grabs it can send model requests on the developer’s account, and the developer pays the bill. Three months after the researchers warned the developers, only 28% had fixed it.
The work, from researchers at Wake Forest University, is the first in-depth study of the problem on iOS. It is striking partly because of how little effort the snooping took. The team used a tool they built, LLMKeyLens, that watches an app’s traffic and pulls out the credentials as they go by. No jailbreaking, no cracking the app open.
The key is the secret that lets the app call a service like OpenAI or Google Gemini. Embed it in the app, and it is exposed with every request the app makes.
All 282 fell into one of three groups:
For 28 of the 54 plaintext-key apps, the same request also exposed the app’s hidden system prompt, the behind-the-scenes instructions that define what the assistant does and how the product works. One capture, two prizes.
The leaks span at least ten AI providers, with OpenAI the most common, and reach across 13 app categories. Productivity apps were the biggest group; health and fitness apps had the highest leak rate. Finance and medical apps, notably, leaked nothing. Most affected apps were small, but not all of them: one had more than two million user ratings.
This is not theoretical money. Stolen AI keys feed a practice the industry calls LLMjacking, where attackers run other people’s keys to get free model access. Sysdig calculated a worst-case scenario in which stolen credentials could run up more than $46,000 a day in AI charges.
The researchers notified all 282 developers and waited three months. Only 28% had clearly fixed it.
Another 23% were still wide open; the leaked access was working. The rest had gone offline, become unreachable, or returned errors. The token apps were often the worst: one popular app, with over 100,000 ratings, set its access token to expire in the year 2125, a hundred-year pass.
Another app’s one-hour token still worked 128 days after it had expired.
The fix is old advice that few followed: Do not put the key in the app. Route AI calls through your own server, make that server check who is calling, and revoke any key that has already leaked.
The researchers also want AI providers to label client-side keys as unsafe in their documentation and to flag keys that suddenly get used by thousands of devices, and they want Apple to screen for this during App Store review.
The pattern is familiar. A 2025 study, LM-Scout, found the same insecure AI wiring across Android apps and automatically broke into 120 of them. A larger audit, Leaky Apps, pulled secrets from thousands of Android and iOS apps and found developers routinely fail to revoke keys even after removing them, leaving the old ones live.
Others have probed the broader LLM app ecosystem for similar holes. The AI rush has not changed the habit. It has raised the bill, because a leaked key is now charged with the token.
One caveat: the two-thirds figure is a floor. Many apps blocked the interception entirely, and the study covers only the US App Store in late 2025, so the true rate is likely higher.
Learn how to uncover hidden AI use, see what data it can access, map every AI action to a human owner, and apply practical governance without heavy infrastructure changes.
Learn how to contain Mythos-style AI attacks with practical Zero Trust controls that reduce exposure, stop lateral movement, and limit risk.
Get the latest news, expert insights, exclusive resources, and strategies from industry leaders, all for free.
