Breaking

282 iOS LLM Apps Found Leaking API Credentials in Wake Forest Study

July 4, 2026 at 05:53 EDT

Security
Foundation Models

Researchers at Wake Forest University examined 444 LLM-integrated iOS apps on the U.S. App Store and found that 282 of them (64%) exposed LLM API credentials over network traffic, with more than half confirmed to be exploitable.

Empirical study · LLM-enabled iOS apps

64% of AI-powered iOS apps leak their LLM API keys

Of 444 LLM-enabled iOS apps analyzed from the US App Store, 282 exposed backend credentials — and 146 were fully exploitable. The flaw opens the door to "LLMjacking," where attackers run inference on someone else's key and shift the bill to the developer.

282

apps leaked credentials
(of 444 analyzed)

146

fully exploitable apps

$46K+

potential loss per day
in a flagged case

444 analyzed apps — how many leaked

Leaked · 64%

Clean · 36%

Leaks spanned 10+ LLM providers and 5 cloud platforms — OpenAI most common.

Three leak patterns (app count)

136

Replayable
tokens · 48%

Unauth backend
proxy · 33%

Plaintext API
keys · 19%

The token that never dies

One popular app with 100,000+ ratings set its token to expire in the year 2125.

Most replayable tokens were still valid when captured. Highest leak rate by category: Health & Fitness at 47%. No leaks confirmed in Finance or Medical apps.

All 282 developers notified — status 3 months later

28%

confirmed fixed

23%

still exploitable

Recommended fix: enforce a backend proxy with server-side authentication. The study calls it a structural problem across the iOS ecosystem and urges stronger App Store review.

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.