Definition
An API key is a secret password that gives access to a paid AI service (such as OpenAI or Anthropic). Exposure happens when that key is accidentally stored in a publicly accessible place — a website database, a plugin configuration file, or a code repository — where an attacker can find and steal it.
Why it matters
A stolen AI API key lets an attacker run unlimited queries at the victim's expense, access proprietary data sent to the AI service, and potentially manipulate the AI outputs seen by end users. Multiple vulnerabilities in AI plugins disclosed this period exposed API keys to low-privilege attackers.