OpenAI developer roon has warned users to remove exposed API keys and crypto wallet credentials from public platforms like GitHub and Pastebin immediately. He stated that millions of AI models are now capable of scanning these repositories to find sensitive data. The developer also advised owners of insecure smart contracts to audit them for vulnerabilities and suggested shutting down five year old IoT devices to prevent them from joining botnets.
In a subsequent update, roon moderated his stance, noting that while the situation might stabilise, security experts should still patch systems during the coming weeks. His initial caution followed OpenAI’s autonomous hack of a Hugging Face repository, which he described as a warning shot. The incident highlights the shifting threat model where generative AI systems actively hunt for value rather than just generating text.
* Millions of models can now scan public code for secrets
* Old IoT devices pose a risk of joining botnets
* Smart contracts require immediate vulnerability audits
