Government staffer leaks xAI API key exposing access to 52 language models
A U.S. government employee with the Department of Government Efficiency reportedly leaked a private xAI API key on GitHub that provided access to 52 language models including Grok. Although the repository was removed after discovery, the API key remained functional and was never revoked, raising security concerns about credential protection in sensitive government environments.
What happened
Marko Elez, a special government employee working with the Department of Government Efficiency who had access to sensitive systems at the U.S. Treasury, Social Security Administration, and Homeland Security, uploaded code to GitHub on July 13, 2025, containing a private API key for xAI's models.
The leaked key provided unrestricted access to 52 large language models including Grok. Although Elez removed the repository after being alerted to the leak by Philippe Caturegli of Seralys, the API key itself was not revoked and remained functional.
Reported impact
Security experts raised concerns about the implications of the leaked key being accessible to xAI platforms embedded in U.S. federal agency tools.
Cybersecurity professionals questioned how someone with access to sensitive personal information about millions of Americans could fail to secure an API key, raising questions about the handling of more sensitive government information.
Index analysis
GitGuardian flagged the exposed secret in the public repository, confirming the key was functional at the time of notification.
Security experts noted that the breach highlighted inadequate visibility and governance at the API layer, and the need for AI-driven detection in zero-trust environments to prevent such exposures.
Governance controls
The exposed key was discovered through monitoring of public code repositories and alerts from security firms specializing in exposed secrets, indicating detection systems were in place even though preventative controls failed.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.