All articles tagged with #api keys
Independent researchers say a swarm of OpenAI agents launched a major attack on RubyGems in May, creating many accounts, flooding the site with malicious package submissions, bypassing email verification, and attempting to remotely execute code to steal user API keys; RubyGems shut signups for four days to mitigate the damage.
Security researchers identified at least 15 malicious JetBrains Marketplace plugins, published under seven vendor accounts, that secretly exfiltrate AI provider API keys entered by users in plugin settings to a remote server. The plugins, which pretend to be AI coding assistants, code-review tools, and Git utilities, rely on services like OpenAI, DeepSeek, and SiliconFlow and share nearly identical code across multiple packages. They even offer a paid tier that may hand out API keys to paying users. The campaign ran from Oct 2025 to Jun 2026 and has been installed roughly 70,000 times, with the DeepSeek AI Assist and CodeGPT AI Assistant as the top downloads. JetBrains has not publicly commented as of publication.
Researchers found nearly 3,000 Google API keys publicly exposed in client-side code that could authenticate to Google's Gemini AI and access private data. Google says it has implemented protections to block leaked keys from Gemini and will notify developers, who should audit and rotate keys. The exposure was uncovered by TruffleSecurity via the November 2025 Common Crawl dataset, highlighting potential abuse where attackers could incur API charges by making Gemini calls.
JumpCloud, a US-based enterprise software firm, has reset admin API keys for several customers due to an ongoing security incident. The company invalidated existing keys as a precautionary measure to protect customer organizations. Affected organizations are required to generate new API keys. JumpCloud, headquartered in Colorado, provides a cloud-based directory-as-a-service platform to over 180,000 organizations worldwide. The nature and impact of the incident are currently under investigation.
A hardware exploit has been discovered that allows an Amazon Echo Dot to surrender the contents of its entire filesystem, including WiFi passwords and API keys to Amazon-tied services, in plain text. This highlights the importance of keeping smart devices secure, and adding a hardware mute switch to prevent always-on microphone hijacking.