One in Ten Exposed LiteLLM Gateways Still Use the Demo Admin Key 'sk-1234'

Key points

• Wiz Research scanned internet-facing LiteLLM servers in February and found nearly 10% accepted sk-1234, the demo admin key printed in the project's own setup guide.
• LiteLLM is an open-source AI gateway, meaning the middleware a company puts between its own apps and paid AI providers like OpenAI or Anthropic.
• Anyone holding that admin key can read every request passing through the gateway, including prompts, replies and stored API keys for the paid services behind it.
• The problem is not a software flaw but a configuration one: administrators copied the tutorial and never changed the placeholder.
• Fixing it takes minutes. Detecting whether attackers already found the door is harder.

A striking share of companies running their own AI plumbing forgot to change the locks.

Researchers at Wiz scanned the public internet in February for servers running LiteLLM, a popular open-source AI gateway. A gateway is the software a business slots between its own applications and the outside AI services it pays for, like OpenAI, Anthropic or Google. It handles billing, quotas and logging so developers do not have to.

Nearly one in ten of the exposed gateways accepted the string sk-1234 as their administrator password. That string is not a guess. It is the example key printed in LiteLLM's own quick-start documentation, meant to be replaced the moment a real deployment goes live.

Many operators never replaced it.

What can someone do with that key?

A lot. The admin key on a LiteLLM gateway is the master credential. Whoever holds it can read every prompt users have sent through the gateway, every reply the AI models sent back, and the list of paid API keys the gateway uses to talk to providers behind the scenes.

In plain terms: an outsider with sk-1234 can read your staff's private conversations with the AI, see any customer data those conversations included, and walk off with the billing credentials for your OpenAI or Anthropic account. They can then rack up charges on your card until someone notices.

For a hospital piloting an AI note-taker, that could mean patient details. For a law firm, client matters. For a bank, internal analysis and code.

How did this happen?

Copy-paste, mostly. The finding, first reported by The Hacker News based on Wiz Research telemetry, points to a familiar pattern: developers follow a tutorial, get the software working, and move on before hardening it.

The LiteLLM docs do use sk-1234 as a placeholder and do tell readers to change it. The instruction is easy to miss when a team is racing to ship an internal chatbot. The gateway then gets exposed to the internet so remote staff or other services can reach it, and the default credential travels with it.

Automated scanners, both defensive and criminal, sweep the whole internet constantly for exactly this kind of oversight.

What the numbers look like

What should companies using LiteLLM do now?

Check the admin key today, not next sprint. If your gateway is reachable from the public internet and the admin key is sk-1234, assume someone already tried it. Rotate the admin key, rotate every downstream provider API key stored in the gateway, and pull the last 90 days of provider billing to look for spend you cannot account for.

Then decide whether the gateway needs to be on the public internet at all. Most do not. Putting it behind a VPN or an identity-aware proxy removes it from the daily internet-wide scan sweep entirely.

Ordinary customers of companies using LiteLLM have nothing to do here directly. But if you get a notice in the coming weeks that a vendor's AI logs were exposed, this is the shape of incident to expect.