Two-Thirds of AI iPhone Apps Hid the Key Under the Doormat

Every neighborhood has that one house. The spare key lives under the doormat. Or in the fake plastic rock that fools exactly nobody. Or on the top of the door frame, where every person who has ever locked themselves out already knows to check. It feels like a hiding spot. It is, in fact, a public announcement with an extra step.

A team at Wake Forest University just proved that two-thirds of AI-powered iPhone apps do the exact same thing with the keys to their AI. Not metaphorically. Literally. The key is right there in the traffic, and anyone who bothers to look can pick it up and start spending your money.

I read the study on the tram and audibly said “oh no” at a number, which is a great way to make strangers give you space.

The number that made me wince

The paper is called “Mind your key,” and it lands the week after yesterday’s agentjacking story — because apparently this is Leak Your Credentials Week. The researchers built a tool called LLMKeyLens that does something almost rude in its simplicity: it installs an AI app, watches the network traffic the way any attacker with a proxy would, and pulls out any LLM API credentials it sees fly by. No source code. No cracking the binary. Just — watch what the app says out loud when it phones home.

They ran it on 444 real AI apps pulled from the App Store. 282 of them leaked exploitable API keys. That’s not a rounding error, that’s the majority. The leaked credentials spanned at least 10 different LLM providers and 5 cloud platforms — OpenAI, Anthropic, the big clouds, all of it.

And the breakdown of how they leaked is the part every iOS dev should tattoo somewhere visible:

48% leaked through JWT-based tokens — the “we were clever about it” tier that turned out not to be clever.
33% exposed an unauthenticated backend proxy — the app talks to your server, but your server will forward anyone’s request to the model with no questions asked.
19% just… sent the raw API key over the wire in plaintext. The doormat classic.

Notice that only the last 19% is the mistake people think they’re avoiding. The other 81% thought they’d done something safer. They hadn’t.

Why smart people keep doing this

Here’s the trap, and I say this with sympathy because I have felt its pull.

You’re an indie. You want to ship an AI feature this weekend. You wire up the OpenAI SDK, drop your key in a Constants.swift, maybe base64 it or stuff it in the Info.plist so it’s “not in plain sight,” and it works. The demo is magic. You ship.

The thing nobody internalizes until it bites them: your app binary is not a secret. It’s a file that lives on other people’s phones. Anyone can run it through a proxy like mitmproxy, watch the HTTPS traffic (yes, even with ATS — they control the device, they can install their own root cert), and read every request your app makes. Obfuscation buys you about fifteen minutes against someone who’s mildly curious. It’s the same brutal lesson as never trusting the client for receipt validation: if the decision or the secret lives on a device you don’t control, it isn’t yours anymore.

The key you so carefully “hid” is on the doormat. The traffic analysis just lifts the mat.

What they do with your key: LLMjacking

If you’re thinking “okay, worst case someone gets a few free ChatGPT queries on my dime,” sit down for this.

There’s a whole underground economy now called LLMjacking. Attackers harvest leaked keys at scale and either resell access or run their own workloads on your account. Because modern models are expensive and rate limits are generous, a single stolen key running flat out can rack up more than $46,000 a day in charges. A day.

You will find out via a billing alert, or worse, via a bill. Your weekend AI feature becomes a five-figure surprise and a very awkward email to your cloud provider’s support team, who have heard this story before and will not be moved to tears.

And here’s the bleakest stat in the whole paper: the researchers responsibly disclosed to all 282 developers, then waited three months. When they checked back, only 28% had actually fixed it. The rest are still out there, doormat up, key glinting.

The zero-secrets version (it’s not that much more work)

The good news is the fix is well-understood and, in 2026, genuinely not a big lift. You have three real options, roughly in order of effort:

1. Don’t ship a key at all — run the model on-device. For a lot of features — summarizing, classifying, rewriting, extracting structure — Apple’s Foundation Models framework runs a capable model right on the iPhone. No key, no backend, no bill, no traffic to intercept. There’s nothing to steal because there’s nothing to send. When I added the AI bits to ThinkBud, the ones that could run on-device do, and the bundle ships with exactly zero secrets in it. That’s not me being virtuous; it’s me not wanting a $46k Tuesday.

2. Put a thin proxy in front of the model. When you do need a frontier model, the app should never hold the provider key. It talks to a small backend you control — a Cloudflare Worker, a Vercel function, a $5 VPS — and that holds the key, server-side, where the binary can’t reach it. Same shape as the receipt-validation backend, and you can build it in an afternoon.

3. If you have a proxy, actually authenticate it. This is the 33% who thought they were safe. A proxy that forwards anyone’s request to the model isn’t protecting the key, it’s just relocating the free buffet. Gate it: per-user auth tokens, rate limits, abuse detection. The proxy has to know who’s asking and be willing to say no.

The through-line: the model call either happens on a device you don’t control (so ship no secret) or on a server you do control (so keep the secret there and guard the door). There is no third safe place, and “inside the app, but sneaky” is not it.

The honest part

I’m not writing this from a pedestal. Early versions of things I shipped did dumb stuff with secrets, and the only reason none of them ended in a horror-story bill is a mix of luck and small user counts. The 282 developers in this study aren’t idiots. They’re people who shipped fast, believed the binary was opaque enough, and trusted a “hidden” key the way we all once trusted a doormat.

The whole industry sprinted into bolting AI onto everything, the same way it sprinted into vibe coding, and the security conversation is once again showing up fashionably late to a party that’s already on fire. But this one’s cheap to fix. A proxy is an afternoon. On-device is sometimes less code than the SDK you were about to embed.

If you want the practical version — how to build the network layer, where the key actually belongs, how to wire an AI feature without handing the world your credentials — that’s the spine of our AI-tools course in Learn, including a whole lesson on doing networking with AI the right way.

Go check your own apps’ traffic before someone else does. And take the key out from under the mat.