Android AI Apps Leak 730TB of Data Through Hardcoded Secrets
Security researchers analyzing 1.8 million Android apps on Google Play Store found that 72% of AI apps contained hardcoded API keys and passwords in their source code. The leaked credentials, affecting approximately 1 million apps, exposed roughly 730 terabytes of sensitive user data and enabled unauthorized access to Google Cloud services.
What happened
Security researchers at Cybernews analyzed 1.8 million Android apps on Google Play Store and found that 72 percent of AI apps contained hardcoded API keys and passwords stored directly in their source code.
The exposed credentials, linked to approximately 1 million Android apps, enabled unauthorized access to Google Cloud services, with 81 percent of discovered secrets related to Google Cloud projects allowing third-party access.
Reported impact
The leaked data totaled approximately 730 terabytes of sensitive user data, including financial information that could enable account manipulation and transaction fraud.
Hundreds of Firebase databases and exposed storage buckets leaked hundreds of millions of files accessible through automated attacks.
Index analysis
The hardcoding practice resulted from time pressure in AI app development, with developers rushing new AI applications to market without implementing adequate security mechanisms.
Well-known language model APIs like ChatGPT were largely unaffected as they were not created using hardcoding techniques.
Governance controls
Google Play Store deployment processes did not prevent the distribution of apps with hardcoded secrets in their source code.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.