Researchers tested 444 AI chatbot apps for iPhone. They found 282 of them — nearly two-thirds — exposed paid AI access through their network traffic. No jailbreaking required. No cracking the app open.
The team from Wake Forest University built a tool called LLMKeyLens. It watches app traffic and pulls out credentials as they go by. The results break into three categories.
Fifty-four apps sent plaintext API keys — readable from a single captured request. Ninety-two apps routed through a backend server that accepted requests from anyone with no checks at all — an open relay to a paid AI account. Most common: 136 apps used temporary access tokens that leaked in the same traffic. Some weren’t temporary at all.
One popular app — over 100,000 ratings — set its access token to expire in the year 2125. Another app’s one-hour token still worked 128 days after it expired.
For 28 of the 54 plaintext-key apps, the same capture also exposed the app’s hidden system prompt. One request, two leaks.
The leaks span at least ten AI providers. OpenAI is the most common. Productivity apps were the biggest group. Health and fitness apps had the highest leak rate. Finance and medical apps leaked nothing.
The researchers notified all 282 developers. They waited three months. Only 28% fixed it. Another 23% were still wide open. The rest went offline or became unreachable.
The fix is simple: don’t put the key in the app. Route AI calls through your own server. Make that server check who’s calling. Revoke any key that’s already leaked.
The researchers want AI providers to label client-side keys as unsafe in documentation, and to flag keys that suddenly hit thousands of devices. They also want Apple to screen for this during App Store review.
