Preliminary research
API Keys Leaking in PNG Metadata of AI Images
AI-collected research leads through 6 October 2026, including bounded month-by-month reviews of selected social and community sources from January through September. Unranked, incomplete, not community-vetted, and subject to change.
Examines API keys serialized into PNG metadata by AI image workflows. A worked example contrasts executed prompt nodes with the entire saved canvas, including inactive nodes, and a public-image study measures exposure. The reported key-bearing image count is not a count of unique keys or affected users.
Record
- Researcher
- Luke Marshall
- Published by
- Truffle Security
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Luke Marshall, first published at the original source. Preserved copies are kept so the citation survives its host.