DOGE Employee exposes AI API Keys in source code, giving access to advanced xAI models
Take action: Build a culture of not saving API keys, passwords, or any secrets directly into your code. Use environment variables or proper secret management tools instead. If leaking API key becomes a practice, consider stronger discipline and awareness measures, paired with technical scanners to detect secrets in code.
Learn More
A 25-year-old employee at the Department of Government Efficiency (DOGE), has exposed a private xAI API key on GitHub. The leaked key provided unauthorized access to more than four dozen large language models developed by Elon Musk's artificial intelligence company.
The employee committed a code script called "agent.py" to GitHub on July 13, 2025, which included the private application programming interface key for xAI.
This incident is very concerning given the employee's extensive access to sensitive government systems as part of DOGE. They have been granted access to sensitive databases at the U.S. Social Security Administration, the Treasury and Justice departments, and the Department of Homeland Security:
TechCrunch reported in February 2025 that the same person was working at the Social Security Administration; Business Insider found the employee was part of a DOGE detachment assigned to the Department of Labor in March, The New York Times reported in April that the employee held positions at U.S. Customs and Border Protection and Immigration and Customs Enforcement bureaus, as well as the Department of Homeland Security. The Washington Post later reported that the employee had gained access to the Executive Office for Immigration Review's Courts and Appeals System.
The exposure was first detected by GitGuardian, a company specializing in identifying exposed secrets in public and proprietary environments. Philippe Caturegli, from the security consultancy Seralys, confirmed that the exposed API key allowed access to at least 52 different LLMs used by xAI, with the most recent model called "grok-4-0709" created on July 9, 2025.
This person is not the first DOGE employee to publish internal API keys for xAI: In May, KrebsOnSecurity detailed how another DOGE employee leaked a private xAI key on GitHub for two months, exposing LLMs that were custom made for working with internal data from Musk's companies, including SpaceX, Tesla and Twitter/X.
Security experts have expressed serious concerns about the operational security practices demonstrated by this incident. One leak is a mistake, but when the same type of sensitive key gets exposed again and again is a sign of deeper negligence and a broken security culture.
