AI-Powered iOS Apps Leaking LLM API Credentials Through Network Traffic

An empirical study of 444 LLM-enabled iOS apps found 282 (64%) leaked exploitable LLM API credentials via plaintext keys, unauthenticated backend proxies, or leaked JWTs. Using a runtime MITM analysis framework (LLMKeyLens) on physical devices, researchers intercepted traffic, validated active credentials, and observed systemic issues such as long-lived or non-expiring tokens, exposed system prompts, weak interception resistance, and slow or incomplete remediation across affected apps.