Swati KhandelwalJun 30, 2026API Security / Mobile Security
Researchers tested 444 AI chatbot apps for iPhone and found that 282 of them, nearly two-thirds, exposed paid AI access through their network traffic.
In many cases, the path in was visible just by watching what the app sent: a plaintext API key, a reusable token, or a backend server that accepted requests with no key at all.
Whoever grabs it can send model requests on the developer's account, and the developer pays the bill. Three months after the researchers warned the developers, only 28% had fixed it.
The work, from researchers at Wake Forest University, is the first in-depth study of the problem on iOS. It is striking partly because of how little effort the snooping took. The team used a tool they built, LLMKeyLens, that watches an app's traffic and pulls out the credentials as they go by. No jailbreaking, no cracking the app open.
