InferTrail honeypots track stolen API key misuse
Understand this story
InferTrail deliberately leaked 179 API keys in the GitHub repositories of more than 40 organizations and set up two honeypot LLM gateways (one imitating LiteLLM, one imitating an OpenAI-compatible endpoint) to record misuse. Within 35 days, these keys triggered more than 3 million requests in total, of which 9,375 were prompt requests. The purpose of the experiment was to observe how leaked LLM API keys would be used; the report did not specify the types or sources of the remaining requests.
AI overview based on source reports · Updated 2 days ago
Coverage timeline
Follow the coverage to explore different perspectives.
- Hacker News AIWe tracked AI key theft over 35 days. Here's what we learned
The authors seeded over 40 fake organizations with GitHub repositories containing working API keys and URLs for two honeypot LLM gateways (a LiteLLM-style one in New York and a separate router in San Francisco), then logged more than 3 million requests over 35 days. Of 179 published keys, 65 were used to fetch model lists and 18 to send prompts, with six keys accounting for 98.9% of leaked-key prompt requests, and 86% of that prompt traffic came from hosting infrastructure across 53 recorded ASNs. Traffic included relay and key-pool tooling, Telegram bot histories, browser-based key testers, and automated credential brute-forcing of default admin keys.
Activity for this story
- Current comparable activity
- 3
- Peak comparable activity
- 10Nov 13 05:00
- Change in the past 24 hours
- -51%
Trends compare the same fully observed participants, which may cover fewer participants than current activity. Move the pointer or tap the chart to inspect hourly activity; use the left and right arrow keys with a keyboard.