Researchers tested 444 AI chatbot apps for iPhone and found that 282 of them, nearly two-thirds, exposed paid AI access through their network traffic.
In many cases, the path in was visible just by watching what the app sent: a plaintext API key, a reusable token, or a backend server that accepted requests with no key at all.
Whoever grabs it can send model requests on the developer’s account, and the developer pays the bill. Three months after the researchers warned the developers, only 28% had fixed it.
The work, from researchers at Wake Forest University, is the first in-depth study of the problem on iOS. It is striking partly because of how little effort the snooping took. The team used a tool they built, LLMKeyLens, that watches an app’s traffic and pulls out the credentials as they go by. No jailbreaking, no cracking the app open.
The key is the secret that lets the app call a service like OpenAI or Google Gemini. Embed it in the app, and it is exposed with every request the app makes.
All 282 fell into one of three groups:
- Plaintext keys (54 apps): the key is sent in the open, readable from a single captured request.
- No key needed (92 apps): the app routes requests through a server that answers anyone, with no check on who is asking. An open relay to a paid AI account.
- Replayable tokens (136 apps, the most common): the app hands out temporary access tokens instead of the raw key, the approach that is supposed to be safer, but the tokens leak in the same traffic and were usually still valid when captured. Some were not temporary at all, as the cases below show.
For 28 of the 54 plaintext-key apps, the same request also exposed the app’s hidden system prompt, the behind-the-scenes instructions that define what the assistant does and how the product works. One capture, two prizes.
The leaks span at least ten AI providers, with OpenAI the most common, and reach across 13 app categories. Productivity apps were the biggest group; health and fitness apps had the highest leak rate. Finance and medical apps, notably, leaked nothing. Most affected apps were small, but not all of them: one had more than two million user ratings.
This is not theoretical money. Stolen AI keys feed a practice the industry calls LLMjacking, where attackers run other people’s keys to get free model access. Sysdig calculated a worst-case scenario in which stolen credentials could run up more than $46,000 a day in AI charges.
The researchers notified all 282 developers and waited three months. Only 28% had clearly fixed it.
Another 23% were still wide open; the leaked access was working. The rest had gone offline, become unreachable, or returned errors. The token apps were often the worst: one popular app, with over 100,000 ratings, set its access token to expire in the year 2125, a hundred-year pass.
Another app’s one-hour token still worked 128 days after it had expired.
The fix is old advice that few followed: Do not put the key in the app. Route AI calls through your own server, make that server check who is calling, and revoke any key that has already leaked.
The researchers also want AI providers to label client-side keys as unsafe in their documentation and to flag keys that suddenly get used by thousands of devices, and they want Apple to screen for this during App Store review.
The pattern is familiar. A 2025 study, LM-Scout, found the same insecure AI wiring across Android apps and automatically broke into 120 of them. A larger audit, Leaky Apps, pulled secrets from thousands of Android and iOS apps and found developers routinely fail to revoke keys even after removing them, leaving the old ones live.
Others have probed the broader LLM app ecosystem for similar holes. The AI rush has not changed the habit. It has raised the bill, because a leaked key is now charged with the token.
One caveat: the two-thirds figure is a floor. Many apps blocked the interception entirely, and the study covers only the US App Store in late 2025, so the true rate is likely higher.
