InferTrail runs a 35-day LLM API key honeypot and traces how stolen keys get used

InferTrail planted 179 API keys across 40+ fake GitHub organizations and ran two honeypot LLM gateways for up to 36 days, logging over 3 million requests. Only 18 of the published keys were used to send prompts, and six keys accounted for 98.9% of leaked-key prompt requests, while 86% of that traffic came from hosting infrastructure. The authors list three log patterns for spotting key reuse: many model names under one key in a short window, steady-interval checks after a key works, and a shift in source addresses.