Two Thirds of AI-Powered iOS Apps Are Leaking Their Keys

Researchers at Wake Forest University took apart 444 iOS apps built around large language models and found that 282 of them, roughly 64%, were handing out credentials or backend access to anyone willing to glance at the network traffic. Productivity tools, lifestyle apps, education, health and fitness. The pattern showed up everywhere.

The leaks were not subtle. 136 apps exposed authentication tokens. 92 allowed unauthenticated access straight through to the backend. 54 had plaintext API keys travelling in the clear. Twenty-eight of those also leaked the system prompts that shape how the AI responds, which is a small gift to anyone curious about how the app actually works under the hood.

Not just weekend projects

It would be easier to dismiss this if the offenders were all hobby builds. They aren't. Fifteen percent of the vulnerable apps had more than 1,000 ratings, and the most popular one had over 2.3 million. People are using these.

The common thread is architecture. About 55% of the leaks came from custom developer-run backends. The rest split between cloud platforms like Firebase and direct calls to AI providers. Notably, wrapping the call in a proxy didn't save anyone. It just moved the problem one hop further from the developer's attention.

The disclosure response was worse than the bug

Ninety days after researchers disclosed the findings, only 28% of affected developers had actually fixed the problem. Another 23% were still exploitable, either because nobody acted or because the authentication was broken at a design level rather than a config one. The remaining apps had pulled credentials or quietly tightened access, but the habits that produced the leaks in the first place are unlikely to have shifted across the wider ecosystem.

That last point matters more than the headline number. The 444 apps in the study are a sample. The development practices that produced them are not.

What this means if you're buying software

Plenty of vendors are racing to bolt AI features onto existing products. The pitch is usually faster workflows, smarter search, automated summaries. What rarely gets mentioned is that the AI feature is almost always an outbound call to someone else's API, paid for with a key that needs to live somewhere.

If that key ends up on the device, it ends up in network traffic. If it ends up in network traffic, it ends up on someone else's machine. From there, it's a question of how much damage they feel like doing with your provider account.

• Ask vendors where their AI calls happen. On-device, through their server, or directly to the provider from the client?
• Ask about credential rotation. If a key leaks, how fast can it be killed?
• Ask about rate limits and spend caps. Because a stolen key is a stolen credit card with extra steps.

An app advertising AI features is also advertising a new and often poorly guarded path to someone else's cloud bill. The Wake Forest numbers suggest most developers haven't worked that out yet.