--- title: Why are we still handing AI agents API keys? | daily.dev description: AI agents running on their owners' API keys are becoming a prime attack target, and the fix is giving agents their own scoped identities. In October, intruders... canonical: https://daily.dev/posts/why-are-we-still-handing-ai-agents-api-keys--vpbi834xx twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Why are we still handing AI agents API keys? | daily.dev og:description: AI agents running on their owners' API keys are becoming a prime attack target, and the fix is giving agents their own scoped identities. In October, intruders... og:url: https://daily.dev/posts/why-are-we-still-handing-ai-agents-api-keys--vpbi834xx og:image: https://api.daily.dev/og/posts/VPbI834Xx.png og:image:alt: Why are we still handing AI agents API keys? og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Why are we still handing AI agents API keys? **[Builder.io](https://daily.dev/sources/builderio)** · 9 min read · 0 upvotes · 0 comments ## Summary AI agents running on their owners' API keys are becoming a prime attack target, and the fix is giving agents their own scoped identities. In October, intruders targeted Railway, Fireworks AI, Zeabur and OpenCode's Console to steal AI provider keys. LiteLLM's May key leak let an attacker read an agent platform's settings and grab tokens, leading to a poisoned PyPI release. A solo developer got a $15,400 bill after revoking a leaked Gemini key. The author's fix: give each agent its own Google account, its own capped OpenRouter key, and a hard spend-limit card. OpenAI and Anthropic have added workload identity federation for short-lived credentials. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why did attackers breach Railway, Fireworks AI, and Zeabur in October 2026? They were trying to steal AI provider API keys to run distillation attacks, training their own models on another model's outputs using someone else's paid API calls. Railway stated its intruder was 'attempting to obtain AI provider API keys to perform distillation attacks' after breaching the system storing customer environment variables, which halted all Railway builds on October 21. _Teams deploying on platforms like Railway can track emerging credential-theft incidents like this on daily.dev._ ### How did the LiteLLM PyPI package get compromised with a credential stealer? A master key for LiteLLM's experimental Agent Platform leaked into a public repo in May and was never revoked. On October 10 an attacker used it to read the platform's agent settings, including an unscoped GitHub token belonging to the company owner, then collected two maintainers' tokens and used them to publish a poisoned LiteLLM release to PyPI on October 21 that sat live for about two hours and installed a credential stealer. _Developers who depend on LiteLLM or similar gateways can follow supply chain incidents like this on daily.dev before pulling an update._ ### What is workload identity federation and how does it remove the need for long-lived API keys? It's an OIDC-based mechanism, added by OpenAI and Anthropic, where a platform like GitHub Actions vouches for which job is running, and the provider issues credentials that expire within minutes or hours instead of a static key. You configure it once by telling the provider which repos and jobs to trust, so no long-lived secret sits around waiting to be stolen. _Developers deciding how to authenticate CI jobs against AI providers can compare OIDC-based approaches like this on daily.dev._ ## Similar posts on daily.dev - [Token Jacking: Cybercriminals Could Be Stealing Your AI Resources](https://daily.dev/posts/token-jacking-cybercriminals-could-be-stealing-your-ai-resources-os316gpzk) · Unit 42 · 1 upvotes · 0 comments - [AI Agents Are Redefining Credential Management](https://daily.dev/posts/ai-agents-are-redefining-credential-management-iuhusgaco) · Security Boulevard · 0 upvotes · 0 comments - [Agentic AI Has an Identity Problem and Attackers Know It](https://daily.dev/posts/agentic-ai-has-an-identity-problem-and-attackers-know-it-fvn8olett) · BleepingComputer · 2 upvotes · 0 comments - [When AI Agents Stop Asking for Permission](https://daily.dev/posts/when-ai-agents-stop-asking-for-permission-mmplupqog) · Medium · 3 upvotes · 2 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#ai-agents](https://daily.dev/tags/ai-agents), [#oauth](https://daily.dev/tags/oauth) [View this post on daily.dev](https://daily.dev/posts/why-are-we-still-handing-ai-agents-api-keys--vpbi834xx) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Why are we still handing AI agents API keys?","url":"https://daily.dev/posts/why-are-we-still-handing-ai-agents-api-keys--vpbi834xx","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/why-are-we-still-handing-ai-agents-api-keys--vpbi834xx"},"datePublished":"2026-10-27T16:57:33.795Z","dateModified":"2026-10-27T17:06:19.300Z","description":"AI agents running on their owners' API keys are becoming a prime attack target, and the fix is giving agents their own scoped identities. In October, intruders...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/617cfd680725c4f44d1b08c4fa8dbff6?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/617cfd680725c4f44d1b08c4fa8dbff6?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Builder.io","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Builder.io","logo":"https://media.daily.dev/image/upload/s--jap1dv3o--/f_auto/v1791797395/squads/builderio?_a=BAMAMicg0","url":"https://daily.dev/squads/builderio"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/why-are-we-still-handing-ai-agents-api-keys--vpbi834xx","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,ai-agents,oauth","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Builder.io","item":"https://daily.dev/squads/builderio"},{"@type":"ListItem","position":3,"name":"Why are we still handing AI agents API keys?"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/why-are-we-still-handing-ai-agents-api-keys--vpbi834xx#faq","mainEntity":[{"@type":"Question","name":"Why did attackers breach Railway, Fireworks AI, and Zeabur in October 2026?","acceptedAnswer":{"@type":"Answer","text":"They were trying to steal AI provider API keys to run distillation attacks, training their own models on another model's outputs using someone else's paid API calls. Railway stated its intruder was 'attempting to obtain AI provider API keys to perform distillation attacks' after breaching the system storing customer environment variables, which halted all Railway builds on October 21. Teams deploying on platforms like Railway can track emerging credential-theft incidents like this on daily.dev."}},{"@type":"Question","name":"How did the LiteLLM PyPI package get compromised with a credential stealer?","acceptedAnswer":{"@type":"Answer","text":"A master key for LiteLLM's experimental Agent Platform leaked into a public repo in May and was never revoked. On October 10 an attacker used it to read the platform's agent settings, including an unscoped GitHub token belonging to the company owner, then collected two maintainers' tokens and used them to publish a poisoned LiteLLM release to PyPI on October 21 that sat live for about two hours and installed a credential stealer. Developers who depend on LiteLLM or similar gateways can follow supply chain incidents like this on daily.dev before pulling an update."}},{"@type":"Question","name":"What is workload identity federation and how does it remove the need for long-lived API keys?","acceptedAnswer":{"@type":"Answer","text":"It's an OIDC-based mechanism, added by OpenAI and Anthropic, where a platform like GitHub Actions vouches for which job is running, and the provider issues credentials that expire within minutes or hours instead of a static key. You configure it once by telling the provider which repos and jobs to trust, so no long-lived secret sits around waiting to be stolen. Developers deciding how to authenticate CI jobs against AI providers can compare OIDC-based approaches like this on daily.dev."}}]} ```