282 iOS AI Apps Leak API Keys and Open AI Proxy Access in Network Traffic Study

A Wake Forest University study tested 444 iPhone AI chatbot apps and found 282 leaking paid AI access credentials via plaintext API keys, open backend relays that require no authentication, or replayable tokens; these leaks enable 'LLMjacking' (attackers running models on victims' accounts and charging the developer). The leaks affect many app categories and AI providers, only 28% of affected apps were clearly remediated after three months, and researchers urge developers, AI providers, and Apple to change practices to prevent further abuse.