Cyble Finds Exposed API Keys and Service Credentials on 35 AI-Built Websites

Cyble Research and Intelligence Labs found private credentials exposed in public client-side code on 35 AI-built websites after scanning more than 1.3 million newly registered domains over one month and identifying 22,306 AI-built sites. Exposed credentials included live OpenAI API keys, Stripe secret keys, Slack webhooks, Supabase service-role tokens, AWS access keys, GitHub tokens and Google OAuth secrets. Reused templates spread some exposures: one Slack webhook appeared across 13 domains, while one Stripe secret key appeared across four domains under two brands.

Depending on their permissions, the exposed credentials could enable unauthorized charges, access to payment records and other sensitive data, database access-control bypasses or modifications, internal phishing messages, and access to cloud or source-control resources. The research documents exposure and potential abuse, not confirmed attacker exploitation. Organizations should keep secrets server-side, rotate exposed credentials, restrict their permissions and access, and investigate every domain sharing an affected template rather than treating each exposed site as an isolated incident.