Honeypot study traces how stolen LLM API keys are used
Start here
InferTrail planted 179 LLM API keys across more than 40 fake GitHub organizations and ran two honeypot LLM gateways for up to 36 days, logging over 3 million requests to see how stolen keys are used. Only 18 of the published keys were used to send prompts, and six keys accounted for 98.9% of leaked-key prompt requests; 86% of that traffic came from hosting infrastructure. The gateways mirrored LiteLLM and a generic OpenAI-compatible endpoint. InferTrail lists three log patterns for spotting key reuse: many model names under one key in a short window, steady-interval checks after a key works, and a shift in source addresses.
Generated from reports · updated 12 h ago
Report timeline
Follow the reports to see the event from different sides.
- Hacker News · AIInferTrail runs a 35-day LLM API key honeypot and traces how stolen keys get used
InferTrail planted 179 API keys across 40+ fake GitHub organizations and ran two honeypot LLM gateways for up to 36 days, logging over 3 million requests. Only 18 of the published keys were used to send prompts, and six keys accounted for 98.9% of leaked-key prompt requests, while 86% of that traffic came from hosting infrastructure. The authors list three log patterns for spotting key reuse: many model names under one key in a short window, steady-interval checks after a key works, and a shift in source addresses.
Heat for this event
Not enough continuous observations yet to draw a trend.