$1.40 of uncensored GLM 5.3 + one scanner day finds 23 live leaked API keys
dbasch · x · 2026-11-05
Developer dbasch spent $1.40 on GLM 5.3 uncensored plus a day of scanning to show how easy key leakage is: across 39 vendors and 1,346 candidate keys, 23 were still live (1.7% validity rate). He says he won't use them — the point was proving it's possible.
- OpenWeather had the highest hit rate (11 of 27 live); Apify keys carry the most value, holding paid credits and control of running actors; a live Telegram bot token gives full remote control — the biggest blast radius per key.
- Big-name AI keys (OpenAI/Anthropic) are the most commonly leaked but least commonly live — scanners and owner vigilance catch those first. The long tail (apify, openweather, telegram) is where keys stay unnoticed.
- The one live OpenRouter key had no spend limit set.
His takeaway: organizations should use uncensored models to test their own key security, since Anthropic and OpenAI won't allow this without hoops.
More from Models
- GPT-Image 2.6 spotted live, official confirmation still pending — koltregaskes · 2026-11-05
- GPT-6.2 Astra and Sol spotted in Google Cloud Console quotas page — scaling01 · 2026-11-05
- Cognition launches SWE-2 Flash, beating US open-weight models 3x its size — simonguozirui · 2026-11-05
- Screenshot suggests GPT-6.2 Astra and Sol models deployed on Google Cloud — lyraxana · 2026-11-05
- Leak: OpenAI poised to launch two new image models, GPT image 2.6 flare and sunburst — imjustnewatai · 2026-11-05
- Who Should Set the Thinking Depth? Reddit Debates Handing Reasoning Budgets to Models — FearOfEleven · 2026-11-05