AI Service Detector

The ai-service detector identifies API keys for AI and machine learning services.

All findings have Critical severity.

sk-(?:proj|svcacct|admin)-[A-Za-z0-9_-]+T3BlbkFJ[A-Za-z0-9_-]+
sk-[a-zA-Z0-9]{20}T3BlbkFJ[a-zA-Z0-9]{20}

OpenAI keys contain a base64-encoded marker T3BlbkFJ (decodes to “OpenAI”).

sk-ant-api03-[a-zA-Z0-9_-]{93}AA

Standard Anthropic API keys for Claude access.

sk-ant-admin01-[a-zA-Z0-9_-]{93}AA

Administrative keys with elevated permissions.

hf_[a-z]{34}

User access tokens for HuggingFace Hub.

api_org_[a-z]{34}

Organization-level API tokens.

{
  "id": "ai-service-openai-api-key",
  "probe": "env",
  "severity": "critical",
  "title": "AI Service API Key Detected (OpenAI API Key)",
  "message": "An OpenAI API Key was detected in environment variable OPENAI_API_KEY. This credential provides access to AI services and may incur costs...",
  "path": "env:OPENAI_API_KEY",
  "metadata": {
    "detector_name": "ai-service",
    "token_type": "openai-api-key",
    "fingerprint": "sha256:..."
  }
}

• OpenAI: GPT-4 usage can cost $0.01-$0.06 per 1K tokens
• Anthropic: Claude usage has similar per-token costs
• Attackers can run up significant bills quickly

• API calls may expose your prompts and data
• Fine-tuned models could be accessed
• Training data might be extractable

• Attackers could generate harmful content under your account
• Automated abuse could lead to account suspension

1. Revoke the key immediately:

   • Go to platform.openai.com/api-keys
   • Delete the compromised key

2. Check usage:

   • Review usage dashboard
   • Look for unexpected API calls

3. Create a new key with restrictions:

   • Set usage limits
   • Use project-specific keys

1. Revoke the key:

   • Go to console.anthropic.com
   • Navigate to API keys section
   • Delete the compromised key

2. Review account activity for unauthorized usage

1. Revoke the token:

   • Go to huggingface.co/settings/tokens
   • Delete the compromised token

2. Review repository access and activity

1. Use environment variables:

   # Don't hardcode
   export OPENAI_API_KEY=$(op read "op://Private/OpenAI/api-key")
   

2. Set usage limits:

   • OpenAI: Set spending limits in billing settings
   • Anthropic: Configure rate limits
   • HuggingFace: Use read-only tokens when possible

3. Use project-specific keys:

   • Create separate keys for each project
   • Easier to rotate and audit

4. Secure your prompts too:

   • API keys in shell history often accompany prompts
   • Prompts may contain sensitive data

5. Use server-side proxies:

   • Don’t expose AI keys in client-side code
   • Route requests through your backend

6. Monitor for abuse:

   • Set up billing alerts
   • Review usage regularly
   • Use API logs to detect anomalies

• Environment Probe - Checks environment variables
• Shell History Probe - Checks command history