IDOR in AI APIs is the finding I keep seeing on assessments because security teams test the LLM and forget the API layer underneath it. The same broken object level authorization that affects every other API affects the endpoints that wrap your LLM too. Change the user_id parameter in the API request. Access another user's conversation history. Grab their fine-tuned model preferences. Pull their uploaded documents. The LLM didn't do anything wrong — the API layer handed you someone else's…
Showing posts with label ai_api_key_theft. Show all posts
Showing posts with label ai_api_key_theft. Show all posts
Tuesday, May 5, 2026
Monday, April 27, 2026
AI Application API Key Theft via Prompt Injection 2026 — Credential Extraction Attacks
The AI security audit request came from a developer who'd built a customer service chatbot for a small e-commerce business. The chatbot was helpful, well-designed, and had been running for three months without issues. Then a charge of $847 appeared on the company's OpenAI account in a single afternoon — far beyond normal usage. The culprit: the developer had put the OpenAI API key directly in the system prompt so the chatbot could "explain its own capabilities" to users. A…
Subscribe to:
Posts (Atom)