Credential Searches on Google Are Naming AI Gateway Keys
In one week, 50 credential-hunting search variants returned an aperion.ai page, 43 of them naming one AI gateway key. Between October 14 and 17, four reports described what can happen to an exposed key.
Summary
For the seven days from October 5 to 11, 2026, searches for leaked AI credentials returned an aperion.ai page in Google's results 788 times. The searches came in 50 variants. Forty-three of them named one variable, VERCEL_AI_GATEWAY_API_KEY, the key for a hosted AI gateway.
What the searches asked for
Each query paired a variable name or key prefix with a search operator. The operators aimed at places secrets get left: container files, cloud folders and raw files on public code hosts.
| Variable named in the query | Variants | Impressions |
|---|---|---|
| VERCEL_AI_GATEWAY_API_KEY | 43 | 725 |
| COHERE_API_KEY | 4 | 31 |
| TOGETHER_API_KEY | 1 | 30 |
| OpenAI key prefixes (sk-, sk-proj-) | 2 | 2 |
| Total | 50 | 788 |
| Where the query looked | Variants | Impressions |
|---|---|---|
| Raw and blob paths on GitLab and Gitea-style hosts | 20 | 341 |
| docker-compose files | 7 | 147 |
| config files | 6 | 85 |
| secrets files | 5 | 81 |
| .aws folders | 5 | 71 |
| credentials files | 4 | 57 |
| .git and other paths | 3 | 6 |
Thirty-five of the 50 variants ended in strings of wildcards, a pattern consistent with tools paging through results rather than people typing. aperion.ai ranked at an average position of 6.4 and in the top three for 10 variants. No query produced a click.
Why aperion.ai appeared
APERION's SDK and API reference pages each carry a table of provider environment variable names. One lists 20 and the other 19, including all three variables above. The likely cause is that few pages print those names, so a documentation page that does ranks near the top. The tables print names only. On October 14 both pages were checked for key values and for strings shaped like provider keys or tokens, and none was present.
What the next four days added
Four reports in four days described what can happen to an exposed key.
- October 14. Trellix reported that AI agents move credentials out of keychains and cloud vaults into plain text during routine work. An agent that reads a .env file sends its contents to the model provider. An agent that prints its environment writes the values into its transcript and, in CI, into the build log.
- October 15. Symantec reported that the newest version of the Aoki infostealer takes the Codex config.toml and .env files, Claude's .claude.json, and tokens for GitHub Copilot, Cursor, Gemini, JetBrains AI Assistant and Kiro, along with AWS credentials.
- October 16. Help Net Security, reporting Bitsight research, described MONST3R-AI, sold on a criminal forum as an autonomous penetration-testing tool. The buyer pastes in stolen OpenAI, Anthropic and Google keys and sets a budget cap. The seller hosts no model, so each key's owner pays for the scans.
- October 17. OpenCode told users that someone had gained unauthorized access to a legacy system and that provider keys saved in its hosted Console may have been exposed. Keys kept in its command-line and desktop apps never reach the company, its co-founder said. OpenCode put the affected share at 1.4% of Console users, all with an outside provider linked, described the breach as related to a large-scale distillation attack, and asked affected users to revoke and replace their provider keys. Several users said their provider accounts were charged for activity they did not authorize.
What it shows
Read together, the searches and the reports cover each stage from exposure to use. A key is searched for, collected from the files where it sits, copied into transcripts and logs by the agents that use it, and held by services that get breached. Then someone else can spend it, and the account owner pays.
Gateway keys are among the names these queries seek. A provider key opens one provider. An unscoped gateway key reaches every model the gateway account can reach. Vercel's documentation says its gateway API keys "never expire unless you revoke them." It names the variable AI_GATEWAY_API_KEY; the longer form the searches used is the one in APERION's provider table.
A key in a file is standing authority. Whoever holds the string can act as the account until someone revokes the key, and no person approves each call. For calls routed through a control point, runtime governance ties each action to a named person and sends an action that exceeds what that person delegated back to them. A key stolen and used directly at the provider never passes that point, which is why the key itself has to be scoped and short-lived.
The export covers only searches where an aperion.ai page ranked, which favors rare variable names. Widely published names, such as OPENAI_API_KEY, did not appear among the queries that surfaced aperion.ai that week. Nothing here indicates a weakness in Vercel's gateway service.
What to check
- Search repositories, container files and CI configuration for AI provider and gateway variable names, including both AI_GATEWAY_API_KEY and VERCEL_AI_GATEWAY_API_KEY.
- Extend the search to .env files, the AI tool configuration files the Aoki report lists, agent transcripts and CI build logs.
- Rotate any key found, then purge the file from version history. Deleting the line leaves the key in the history.
- Issue keys per workload or per agent, scoped to the models and routes each one needs, with a spend cap and an expiry or rotation date.
- Hold provider credentials at one control point that you operate and monitor, so developer files carry a scoped key or none. When a tool that stores your provider keys reports an incident, revoke and replace those keys at the provider, then review recent usage. Deleting a key from the tool does not revoke it.
- Review usage by key. A gateway key used from an unfamiliar network, or outside its workload's normal hours, is a finding.
Method
Source: Google Search Console for aperion.ai, Performance report, web search, October 5 to 11, 2026, exported October 14, 2026. A query was counted when it contained a credential variable name or key prefix together with a search operator. An impression is one results page that included an aperion.ai page. Impressions do not identify people or tools. Search Console withholds rare queries, which makes these totals a floor. Only Google is covered. Trellix and Symantec are summarized from their own reports, Bitsight from Help Net Security's coverage, and OpenCode from Notebookcheck, Crypto Briefing, BleepingComputer and The Hacker News, as of October 20, 2026. OpenCode had not said how the intruder got in.
Sources
- Vercel, AI Gateway Authentication and BYOK, retrieved October 14, 2026.
- Trellix Research, on AI agents and the credential surface, October 14, 2026.
- Symantec Threat Hunter Team, on the Aoki infostealer, October 15, 2026.
- Help Net Security, "Stolen AI API keys are paying for hackers' autonomous scans", October 16, 2026, reporting Bitsight research.
- Notebookcheck, on the OpenCode breach, October 17, 2026.
- Crypto Briefing, on the OpenCode distillation attack, October 17, 2026.
- BleepingComputer, "OpenCode hack exposes API keys amid AI distillation attacks", October 19, 2026.
- The Hacker News, "OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys", October 19, 2026.
Disclosure: aperion.ai is APERION's site, and the reference pages above are its own documentation. WOPR Report is published by Aperion, Inc.
Signal published October 20, 2026 by APERION. WOPR Report.
Real-time signals respond to events within their reporting window. Full analytical issues are published monthly. Subscriptions and archive: wopr.aperion.ai.