2024-06-25 · 2024-Q2

Rabbit R1 Hardcoded API Keys

Primary layerL1 Credential

Should this run hold this key at all?
The question layer 1 asks, and failed here.

Fixable: Vendor patch
Vendor response: Unknown
In the wild: Yes
Actor: Attacker

Target

Rabbit R1 AI device

Impact

ElevenLabs admin key, Azure, Yelp, Google Maps, SendGrid keys exposed; could crash entire rabbit OS backend

Root cause

API keys hardcoded in device source code instead of secure storage

Sources

Cybernews

Catalog

View this entry in the catalog

Cite this: AgentProv incident record: Rabbit R1 Hardcoded API Keys (2024-06-25). https://agentprov.com/incidents/2024-06-25-rabbit-r1-hardcoded-api-keys

Also L1 · 2026-10-21LiteLLM 1.107.0 on PyPI and Docker Ships a Credential Stealer That Runs at Every Python StartupL1Credential
Also L1 · 2026-10-17OpenCode Console Breach Exposes Users' Stored OpenAI, Anthropic, and Google API KeysL1Credential
Also L1 · 2026-10-13IBM MCP Context Forge Shipped a Known JWT Secret, Letting Anyone Mint Platform Admin Tokens (CVE-2026-53709)L1Credential