Hardcoded Keys Exposed Every Rabbit R1 Device
On this page
Every device shared the same secrets, because the secrets were sitting in the code.
| When | June 2024 |
|---|---|
| Target | Rabbit R1 (AI device) |
| Researcher | 'rabbitude' collective |
| Cause | Hardcoded third-party API keys in the codebase |
| Impact | Access to every device's TTS history; ability to alter responses / brick units |
- 1Researchers obtain and read the Rabbit R1 codebase
- 2They find hardcoded API keys for ElevenLabs, Azure, Google Maps and more
- 3The keys give access to every device's data and the ability to tamper with it
What happened
In June 2024, the 'rabbitude' collective reported finding hardcoded API keys — ElevenLabs, Azure, Yelp, Google Maps and SendGrid — embedded in the codebase of the Rabbit R1 AI device. The access was broad enough to read every device's text-to-speech history and to alter responses or brick units. Rabbit said it found no evidence of a compromise; the keys were later rotated.
How it happened
The R1, like many AI products, stitches together several hosted APIs (voice, maps, email). Their credentials were embedded directly in shipped code, so anyone who read the codebase held keys that worked against the whole fleet.
Root cause
Third-party secrets hardcoded in client code — turning one repository into a fleet-wide exposure.
What a review would have caught
Secret-scanning the build, and a basic threat model of 'what can someone with our client binary do?', surfaces embedded credentials before shipping.
How to prevent it
- Never ship third-party secrets in client code; broker calls through a backend.
- Scope and rotate keys; scan builds for embedded credentials.
- Assume the client is readable — because it is.
FAQ
What could the exposed keys do?
They reached core third-party services the device depends on — e.g. the ElevenLabs voice API, exposing every R1's text-to-speech history — and gave enough control to tamper with responses or brick devices.
Why is this an AI-specific lesson?
AI hardware and apps stitch together many hosted model/voice/map APIs, and their keys often end up in a shipped client. One extracted key can compromise the entire fleet's data and behaviour.
How do you prevent it?
Never ship third-party secrets in client code; broker calls through a backend, scope and rotate keys, and scan builds for embedded credentials before release.
Sources
- rabbit r1 hardcoded API keys disclosure — rabbitude
- Security investigation update — Rabbit