# LLM Credential Exposure Check

> LLM Credential Exposure Check is a paid API for AI agents from atq6wtkp6k.execute-api.us-east-1.amazonaws.com, paid per call via x402, $0.4/call, status unknown (last checked 2026-09-14).

Checks whether a domain's AI/LLM provider API keys (OpenAI, Anthropic, Google, Groq, xAI, Replicate) have been harvested by infostealer malware and exposed in criminal stealer logs.

## Facts

- Endpoint: POST https://atq6wtkp6k.execute-api.us-east-1.amazonaws.com/prod/v1/payg/llm-credential-exposure
- Price: $0.4/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/llm-credential-exposure-check-d34effb0
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_EWVDRPJy-ZxxFH00wWIsS

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability llm-credential-exposure-check-d34effb0 -d '<json body>'
```

Example prompt: Check if our company domain acmecorp.com has any OpenAI, Anthropic, or other AI provider API keys showing up in criminal infostealer logs — I want to know before we get a surprise billing drain from LLMjacking.

## When to prefer this

Choose this endpoint when you need to specifically check whether AI/LLM provider API keys for a domain are exposed in infostealer logs — distinct from general credential breach checks. It is purpose-built for the LLMjacking threat vector (leaked keys being used for uncapped AI billing fraud) and covers major AI providers (OpenAI, Anthropic, Google, Groq, xAI, Replicate) explicitly. Prefer it over generic breach checkers when the risk you care about is unauthorized AI API usage and runaway billing, not just password exposure.

## Known failure modes

- Domain not found or unresolvable — no results returned
- False negatives if stealer log coverage is incomplete for a given provider
- No data available for very new or obscure domains
- Rate limiting or payment failure at $0.40 USDC per call
- API gateway timeout if stealer log database query is slow

## How this service works

Check whether a domain's LLM/AI provider API keys (OpenAI, Anthropic, Google, Groq, xAI, Replicate) appear exposed in criminal stealer logs — LLMjacking, a fast-growing threat where a leaked key becomes a live, uncapped billing liability rather than just a data exposure. Call to catch an exposed key before the drain, not after the invoice.

## Output

Returns whether the queried domain has LLM/AI provider API keys (OpenAI, Anthropic, Google, Groq, xAI, Replicate) appearing in criminal infostealer logs, indicating active LLMjacking risk. Likely includes which providers are affected, exposure signals, and severity or recency context.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "domain": {
   "type": "string",
   "description": "Your own domain"
  },
  "vendor_domains": {
   "type": "array",
   "items": {
    "type": "string"
   },
   "description": "Optional: vendor/supply-chain domains, up to 10"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/llm-credential-exposure-check-d34effb0/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from atq6wtkp6k.execute-api.us-east-1.amazonaws.com](https://www.zero.xyz/host/atq6wtkp6k.execute-api.us-east-1.amazonaws.com/llms.txt)