The problem in one sentence
Many AI apps add an endpoint like /api/chat that takes a prompt and forwards it to an AI model using your secret key. If that endpoint does not check who is calling, anyone who finds it can call it as much as they want, and the bill is yours.
How attackers find it
They do not need to guess. Your own front-end calls the endpoint, so the URL is right there in your public JavaScript. Automated tools scrape sites for these endpoints and hammer them.
Once found, a single script can send thousands of requests in a loop. With a pay-per-use model, that turns into a real bill very quickly.
How to lock it down
- •Require authentication. Only signed-in users should be able to call the endpoint.
- •Add rate limiting per user and per IP, so even a valid user cannot send thousands of requests a minute.
- •Keep the model key server-side. The browser should call your endpoint, and your endpoint calls the model.
- •Set a hard usage cap or budget alert with your AI provider, as a safety net.
- •Validate input size, so nobody sends huge prompts that cost more per call.
How to check
A scan can flag AI endpoints that respond without any authentication, which is the clearest sign you are exposed. Our AI app security scanner looks for exactly this.