WARNING: Leaked OpenAI API Keys

Key Takeaways

you've got to make sure to keep your open AI API key safe because people are pirating gpt4 keys that are exposed online there are a lot of different places where people without any diligence just put their actual raw key opening a API key and now hackers or Pirates Who are you want to call them they started scraping for this particular information from the internet and then also trying to give it to some other people for free this is this article by motherboard you can see that people are pirating gpt4 by scraping API keys and in fact one of the account that they hacked and managed to get into is an account with 150 000 worth open AI access now if you get in the details of this there is a subreddit called R chargpt quite popular one since chargpt became popular the subreddit was popular and that separated has got its own Discord and on that Discord people are advertising uh people who are part of the Discord or advertising that they have stolen open AI API tokens and these have been scraped from chat logs screenshots and interviews and different different and and of course like the biggest one is code and these tokens or keys are that are stolen from them are being used to let's say use for their own account like you do not have to pay for open a so in one particular case somebody has stolen a key that has upper limit of 150 000 worth of usage imagine like your upper limit is 150 000 and you keep on using it and that person has to pay it and until unless that person is really good and they're technical enough to actually go to open Ai and make this complaint and this is just going out of somebody's pocket and this is quite a serious issue and a lot of developers and a lot of people who are not quite good at programming have started getting into this API opening AAP because of the popularity of charge GPD now if you do not know about environment variable if you do not know about git ignore how you have to ignore the API keys and all the other things that you have to mask now what's been happening is that people have been putting these things as part of the codes and now we almost started paying price for that that particular Discord has more than 500 members and if you actually see um one of the things that open a has been advertising recently is to say that remember your APA key is a secret do not share it with others are export it expose it in any client-side code browsers or applications that's why I've been quite wary about covering applications that ask for your API key there has been in this concept called bring your own API key and I have always tried to avoid covering those applications because I'm not quite entirely comfortable putting my APA key and a web application or place where people can take it I know for sure if I can see their open source code and if I'm if I can make sure that the data is not being captured but otherwise it's always a risk and this is something that open a has been advertising another thing that you need to do if you are going to use open AI for a business is setting an upper limit because that's quite important it's like setting an upper limit for your credit card or debit card you don't want somebody to just bill you hundred thousand dollar fifty thousand dollar you need to set some upper limit that can actually help you not pay the price if somebody hacks into your account like first of all don't put your APA key anywhere on internet and um that that goes for everything so the way in which the Pirates gained access is uh by scraping the websites where people are collaborating for coding projects especially like website like repellent where uh repellent has been encouraging people to create GPT based application and a lot of repellent users are not pro coders like not professional programmers so what these people have been doing is they've been hard coding their API key which is kind of sad because it's it's just lack of knowledge it's not intentional and they did not realize that while adding the API key in Internet can publicly access it people can access it the worst part is the account who who shared this um in fact where uh you know they've created a web application like this and giving some part of gpt4 API access for free um they've claimed that even after doing all these things uh people have not like open a has not banned their account and uh open a has not like commented much on it it's just that they've said that they they they do some scans like automated scans and based on the automated scans they they actually you know ban the accounts where they feel that something has been happening but but ultimately um it's it's just like somebody else's money and people have taken it and they are actually trying to either expose it or give it to somebody but this this is a problem so if you're a if you are a subscriber of this channel uh you most likely would have known at this point that you should not expose your APA key and have been a strong advocate of rotating APA key even if you expose your API key regularly rotating your API key is one of the easiest way to make sure that even if somebody has access to the key the key will not work after a given time period so these are the three things that you need to do first thing make sure your EPA key is not shared anywhere in public if you ever doubt that your API key is shared then the step to rotate your APA key step 3 always add upper limit and if you want to do the step four please share this video with your friends who might be doing the same mistake because now this is a big problem where people are pirating APA keys and sharing it with others so you might be losing money at one end and somebody might be using the feature that you are not using and it's it's not that everybody is tracking their API spend open a account spend hope this video was helpful to you this article will be linked in the YouTube description see you next video Happy prompting and safe from