Hundreds of AI-powered iOS apps found exposing credentials

Researchers analyzed 444 iOS apps with LLM features and found 282 (26%) exposing exploitable credentials or backend access mechanisms—136 exposed authentication tokens, 92 allowed unauthenticated backend access, and 54 exposed plaintext API keys (28 of which also exposed system prompts). The leaks spanned productivity, entertainment, lifestyle, education, utilities, and health & fitness apps, affected both small and popular apps, and persisted in many cases after responsible disclosure, leaving a substantial portion still exploitable.