One day, one of our tiny AI apps got almost 5,000 requests. Its real users send <50 in a month.
When we dug in -> Bots. Almost all of them.
Hunting for our secret keys. They found nothing.
Someone even tried to run paid AI models on our account. Our spending limit stopped it.
We still found a few holes and fixed them. Then asked an AI agent to review our fixes.
It found holes in our fixes 🙈
Before the bots find your holes, let AI find them.