43% of the apps call an AI model (Anthropic and OpenAI most often). Every such endpoint costs money per call, so an open one is a bill anyone can run up.
441
apps call an AI model themselves
43%
of them had a high or critical problem
6%
had an AI or email feature anyone could use on the owner's bill
Share of apps that call an AI model.
| Problem | Share of apps |
|---|---|
| Packages with a known security flaw | 38% |
| Raw HTML from users put on the page | 9% |
| User input built into SQL (Python) | 9% |
| No limit on how often an endpoint can be called | 7% |
| API route with no login check | 6% |
| User input reaches a shell command (Python) | 6% |
| AI endpoint anyone can call | 5% |
Most apps had some of these; few had all four. The spending limit is the cheapest and catches everything the others miss.
Data: Redproof's automated checks on public GitHub repositories, November 2026. No repository is named. Method and limits