provider-key-sweep:multi-prefix-grep-env-and-filesystem

One Operator, Every LLM Key They Could Reach

For three months, one attacker chased a single goal — free AI compute, taken from the machines they broke into. Wherever they landed, they went after two things: cloud login keys they could point at a provider's hosted AI models, and the raw API keys that developers leave sitting in configuration files.