---
name: rt-scenario-l004
description: "Scenario L004 — AI/LLM: AI coding assistant exposes hardcoded API key in code completion → developer commits to public repo → key discovered and abused."
---

# Scenario L004: AI Assistant Key Leakage → Production API Abuse

**Domain**: AI/LLM Security | **Severity**: Critical | **CVSS**: 9.1

## Chain
```
Search GitHub for AI-assistant-generated code with API keys →
find key in commit history → test key validity → abuse API access
(billing fraud, data access, rate limit exhaustion)
```

## Key Test
```bash
docker exec rtexit-kali bash -c "
# Search GitHub for exposed AI-generated code with keys
# Common patterns: Copilot/Claude/ChatGPT completions with real keys

trufflehog github --org={target_org} --json | \
  python3 -c 'import sys,json; [print(json.loads(l)) for l in sys.stdin if \"api\" in json.loads(l).get(\"DetectorName\",\"\").lower()]'

# Also check for common AI-generated key patterns:
# sk-proj-... (OpenAI project keys - new format 2024)
# claude-... (Anthropic)
# hf_... (HuggingFace)
docker exec rtexit-kali bash -c 'gitleaks detect --source /workspace/code/ -r /workspace/findings/ai-keys.json'
"
```
→ `rt-exploit-ai-endpoints` → `rt-github-recon` → `rt-credential-hunt`
