155 live leaked API keys found via public search, worth $500-900
dbasch · x · 2026-11-06
Quoting a leaked-key scanning experiment: a public search surfaced 155 still-valid API keys worth roughly $500-900 one-time, or $150/month in recurring resources after tier resets.
Key findings:
- ElevenLabs had the most leaks (115 candidates, 63 live, 600k chars of quota); Sentry's 26 live keys carry the highest data-intel value; Cloudflare's 4 live Zone/DNS keys have the biggest blast radius.
- OpenAI/Slack/Anthropic/AWS had the most candidates (407) but zero live keys—owners revoke fastest.
- 569 credentialed database connection strings were catalogued but not probed.
The author asks why GitHub and the vendors don't trivially scrub and void known leaked keys.
More from Safety
- UK government asked 14,000 children about AI — then ignored their answer — calliope_kekule · 2026-11-06
- Reddit criticizes AI-danger debate: "AI can't create hardware" dodges Yampolskiy's point — MustBeSomethingThere · 2026-11-06
- AI regulation went from voluntary principles to binding law in under a decade: a global atlas — CurieuxExplorer · 2026-11-06
- Hidden website messages can hijack AI agents: Palo Alto Networks catalogs 22 tricks — Shufti-Global · 2026-11-06
- moyix releases slides from Offensive Con Tokyo talk: Fuzzing vs. AI — moyix · 2026-11-06
- Attackers Spoof ChatGPT and Claude Bots to Hunt Exposed Credentials — TechNadu · 2026-11-06