{
  "id": 18283582,
  "title": "OpenAI or Anthropic API key exposed in the browser",
  "url": "https://urgent.news/2026/11/05/openai-or-anthropic-api-key-exposed-in-the-browser",
  "topic": "ai",
  "section": "AI",
  "published": "2026-11-05T09:40:53.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/axonscape/openai-or-anthropic-api-key-exposed-in-the-browser-5940"
  },
  "original_language": "en",
  "account": "An AI application was discovered to have inadvertently exposed its API key in the browser. This occurred when the application was created using dangerouslyAllowBrowser: true, or when the key was stored with a prefix such as VITE_ or NEXT_PUBLIC_. Once the browser runs the application, anyone viewing the page can easily copy the API key and use it to make unauthorized requests, potentially incurring costs on the original account.\n\nThe issue arises because any code executed by the browser is accessible to all visitors. Since the key has public prefixes, it becomes bundled within the JavaScript that everyone downloads. To rectify this situation, the API key should be immediately revoked from the provider's dashboard, as it has already been distributed.\n\nA recommended solution is to retrieve the AI key from a server-side route that has been configured with a new key lacking the public prefix. The browser should then make calls to this server route. Additionally, implementing a per-user rate limit can help prevent abuse. Alternatively, the application developer could request the AI tool itself to address the issue.\n\nThis vulnerability was discovered by Launchpad, a free launch check service offered by Axonscape. Launchpad reviews applications built with AI tools, identifying potential launch issues from a public GitHub repository or a .zip file containing the code, while ensuring no sensitive data is shared. The complete page, including a ready-to-copy request, can be found at launchpad.axonscape.com/fix/ai-api-key-exposed-in-browser.",
  "summary": "An AI client created with dangerouslyAllowBrowser, or a key behind a VITE_ or NEXT_PUBLIC_ prefix, puts your API key in the page, where anyone can copy it and spend on your account. What you see The OpenAI or Anthropic client is created in a component, with dangerouslyAllowBrowser: true , or the key is read from VITE_OPENAI_API_KEY or NEXT_PUBLIC_… . Why it happens Anything the browser runs,…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 3,
    "also_reported_by": [
      {
        "outlet": "Expansion ES",
        "title": "The new battle between OpenAI and Anthropic: attracting companies with cheaper AI",
        "url": "https://urgent.news/2026/11/04/la-nueva-batalla-entre-openai-y-anthropic-atraer-empresas-con-la-ia",
        "published": "2026-11-04T23:26:32.000Z"
      },
      {
        "outlet": "Business Insider",
        "title": "Cat Wu joins OpenAI from Anthropic in huge product-lead coup",
        "url": "https://urgent.news/2026/11/05/cat-wu-joins-openai-from-anthropic-in-huge-product-lead-coup",
        "published": "2026-11-05T00:57:29.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}