Mollick moves AI security from the lab to pastebins and personal keys

Ethan Mollick on 6 August 2026 quoted a warning on X that API keys, eth wallet secrets and other credentials sitting on pastebins and public GitHubs should come down before the tireless eagle eyes of a million models find them. He adds that AI security must be taken seriously at the individual level too. If current OpenAI and Anthropic models are not the ones doing it, open-weight models will when they catch up.

The public internet stops being a safe dump for secrets

The quoted post (tszzl) is practical: anything findable on the open web is findable by agentic scanning. Mollick generalises it. It is no longer enough to assume only big labs have the capability for systematic leaked-secret search. The open-weight curve from his earlier writing (near-frontier with a lag of months, cheap to run) means more parallel scanners outside any vendor control plane.

For developers, freelancers and small teams this shifts from a compliance checklist to account hygiene: key rotation, secret scanning in CI, no committed .env, audits of old gists and forks. This is not new cryptography. It is recognition that the cost of broad public-web search falls with every cheaper tool-using model.

Individual risk rises before a corporate SOC shows up

Closed labs still hold stronger guardrails and abuse monitoring. Mollick separates two layers. Companies run red teams and classifier policy. An individual checks whether a staging token is still in a public issue even 2 years old. Open weights widen that gap: a model can run elsewhere, without vendor telemetry and without the rate limits a lab puts on its own API.

That hits people who keep crypto wallet seeds, cloud access keys or customer tokens in personal repos. Not because AI is evil, but because hunting leaked secrets is a routine job an agent can do cheaply without sleep. Mollick's line that if things can be found on the open internet they will be found is an operating assumption, not philosophy.

A tweet is not an incident report and does not replace forensic proof

The source is a short quote-tweet, not an audit or paper. It does not claim a named model just cleaned out pastebin X. It gives no timeline or volume. Turning it into AGI wallet-theft panic overreads it. Turning it into a sprint on secret rotation and public-artefact cleanup reads it correctly.

There is also no hard count of how many models already scan this way. The signal strength is the responsibility shift: AI security stops being only a lab-board topic and becomes personal operational discipline once tool-using agents get cheap.

Clean public traces and key rotation will show who heard it

Watch behaviour, not another thread. First, whether secret scanning spreads in ordinary dev workspaces (GitHub Advanced Security, gitleaks in CI, pre-commit hooks). Second, whether public writeups appear about agents systematically harvesting leaked credentials. Third, whether open-weight release notes and community tooling treat public-web abuse scanning as a default individual threat model.

As long as keys stay in old gists longer than 24 hours, Mollick does not need to exaggerate. One cheap agent with a browser and more patience than a human weekend is enough.

Lilith's verdict

Mollick is not adding another lab scare. He is telling the freelancer with a token in a public gist that the overnight model scanner will not wait for your spring repo cleanup.