Case doge-xai-api-key-leakModel & data leakUnited States
DOGE staffer Marko Elez leaks xAI API key granting access to 52 Grok models
Marko Elez, a DOGE employee with access to sensitive federal databases, committed a script containing a private xAI API key to public GitHub; researchers found it unlocked at least 52 xAI models and it was still valid after the repo was pulled.
HighAttack on AIStatus: ResolvedVerified case file
Open in the interactive mapCite this case
- Reported
- Jul 14, 2025
- Location
- United States
- Target
- xAI private LLMs including grok-4-0709
- Severity
- High
- Triggered by
- Marko Elez (DOGE); found by GitGuardian and Philippe Caturegli
- Actor type
- Accidental / misconfiguration
- Reported loss
- None reported
- CVE
- None
What happened
Marko Elez, a DOGE employee with access to sensitive federal databases, committed a script containing a private xAI API key to public GitHub; researchers found it unlocked at least 52 xAI models and it was still valid after the repo was pulled.
Impact: Access to at least 52 xAI LLMs, including the newly built Grok 4, under a government developer's credentials; no evidence of misuse was published
Who triggered it
Actor: Marko Elez (DOGE); found by GitGuardian and Philippe Caturegli
Attribution: Accidental commit by Elez, confirmed by GitGuardian secret scanning and Seralys' Philippe Caturegli; second such xAI key leak in three months
Motive: None; accidental secret exposure
How it happened
Attack vector: Private xAI API key embedded in agent.py pushed to a public GitHub repository
Root cause: Credential hygiene failure by a user with privileged government data access; no automated key revocation after exposure
Timeline
- Newest exposed model grok-4-0709 is created
- Elez commits agent.py with the private xAI key to GitHub
- Krebs reports the leak; repository removed but key still works and is not revoked
Response
Repository deleted after Caturegli contacted Elez; neither Elez nor xAI commented; researchers questioned DOGE's handling of far more sensitive data
Current status: Resolved
Sources (open in a new tab)
- KrebsOnSecurity krebsonsecurity.com
- TechRadar techradar.com
- Quartz qz.com
Cite this case
DOGE staffer Marko Elez leaks xAI API key granting access to 52 Grok models. AI Threat Watch, case doge-xai-api-key-leak, Jul 14, 2025. https://aithreat.io/cases/doge-xai-api-key-leak/
Permanent link: https://aithreat.io/cases/doge-xai-api-key-leak/