The Rising Risk Of Exposed ChatGPT API Keys

CRIL discovered widespread, systematic exposure of ChatGPT/OpenAI API keys—over 5,000 public GitHub repositories and around 3,000 live websites—leading to easy harvesting and abuse by threat actors for inference fraud, phishing, malware development, and billing theft; the report emphasizes that AI API keys are production secrets, outlines attacker monetization and detection gaps, and provides prescriptive mitigations (remove keys from client code, enforce secret scanning, apply least privilege, and monitor AI usage).