Sourcegraph LLM API key/admin-token abuse and rate-limit manipulation
Date: 2023-08
Affected: Sourcegraph
Attack vector: auth-bypass
Category: real-world
Severity: High

A malicious actor used a leaked admin access token at Sourcegraph to alter API rate limits, enabling abnormal request volumes against the LLM-backed service — an early example of OWASP LLM10 Unbounded Consumption.


Mitigations:

Architectural layers (MAESTRO):