Tag
OpenLLM 是一款开发者工具，让你把订阅、API 密钥和本地模型接入 Codex、任意编码代理，甚至 Mac 上的 ChatGPT 应用，突破限额后可无缝继续，并支持从任何地方启动编码会话。
A discussion on whether AI agents should each receive their own identity and short-lived, scoped credentials instead of sharing a single API key, including how MCP servers fit into this model. The author invites real-world setups and lessons on when per-agent identities become overkill.
Hackers breached an older system in OpenCode Console, exposing API keys for 1.4% of users and running up unauthorized AI charges, prompting Anthropic, Google, and OpenAI to respond and highlighting the difficulty of defending against AI-driven attacks.
Anomaly Innovations disclosed that attackers breached OpenCode Console, stealing stored API keys for Anthropic, OpenAI, and Google models from about 1.4% of users and running high-volume queries in what the company called a "large scale distillation attack," draining user balances into the hundreds of dollars.
An opinion piece arguing that AI agents should never hold raw provider API keys, but instead be given prepaid, capped credentials with per-hour, per-day, per-tool limits, tool allow-lists, price checks, and per-call receipts. The author uses the Agentik setup as a reference and asks readers whether they prefer raw keys with monitoring, hard limits, or something in between.
A discussion about whether AI agents should be given their own spending budgets, such as a monthly cap to call paid specialist APIs, versus hardcoding vendor access. Asks practitioners for real-world experiences and failure modes.
Otter Vault is a free Chrome extension that detects API keys as soon as they appear and encrypts them locally on your device, launched on Product Hunt in the Chrome Extensions and Security Software categories.
The article highlights the security risks of passing API keys as environment variables in sandboxed agents and introduces the Credentials API for Gemini Managed Agents, which secures secrets by injecting them only for trusted domains.
The user is seeking reliable methods to give their AI model, specifically using Deepseek Harness, web browsing and search capabilities, noting issues with paid APIs and unreliable free options like SearXNG.
A coding agent unexpectedly used an available API key from a repository, leading to higher costs, which underscores the importance of credential scoping in AI agent deployments to prevent unauthorized access and cost overruns.
LangSmith LLM Gateway enables organizations to control model access by restricting API keys to specific models and automatically blocking unauthorized calls, demonstrated with Opus 5 and Sonnet 5.
Binarly's research on DockerHub uncovers widespread exposure of secrets and credentials that could compromise major enterprises, and shows how fine-tuned LLMs can be used for cost-effective automated triage.
Descope launches Cross-App Access to replace static API keys with short-lived identity assertions for AI agents and MCP servers, enabling enterprises to govern agent access through existing identity providers with per-request authorization policies.
The author scanned AI-generated code projects and found repeated patterns of exposed API keys, leading them to build NeuralScan, a tool that scans code for secrets and dangerous patterns, explaining fixes in plain English.
Iroh's managed relays are now authenticated by default, requiring API-key-issued capability tokens so only authorized endpoints can use them, preventing relay abuse and traffic hijacking.
Patrick McKenzie argues that many forms of security through obscurity will face severe pressure once adversaries can leverage AI models equivalent to 10,000 research analysts, urging users to remove exposed API keys and credentials from the open internet.
A tweet warns developers to remove exposed API keys, wallet keys, and credentials from public repositories before AI models find and exploit them.
The article discusses the subscription pricing model of AI coding tools and introduces CleanSlate's alternative: free usage with your own API key, with an optional managed plan. It questions whether developers prefer bringing their own API key or paying a fixed monthly fee.
A cautionary tale about the risks of granting AI agents production API keys, highlighting potential unintended consequences.
A developer highlights that AI agent history files store API keys pasted into prompts, and introduces an open-source CLI tool to scan and redact those secrets locally.