Research
We leaked LLM gateway api keys for 35 days. Here's what happened.
Publication date unknown · Discovered infertrail.com
Page published
Publication date unknown · First observed: 13 Nov 2026
Coverage timeline
Single-source research — one report is available.
Why it matters
InferTrail’s findings highlight the need to detect exposed LLM gateway credentials and monitor for unauthorized inference and resale of access.
InferTrail deployed two honeypot LLM gateways and deliberately exposed 179 API keys in GitHub repositories to study unauthorized use. The study recorded 9,375 prompt requests using documented leaked keys, including 4,711 successful requests, and reported traffic patterns consistent with inference resale and connections to agent harnesses.