OpenCode, a popular open-source AI coding tool, lost control of an old system it was in the middle of shutting down, and the attackers who got in used the API keys stored there. An API key is the long password that lets a program use OpenAI, Anthropic or Google's models and bills the owner's account. About 1.4% of the people using OpenCode's online Console had saved keys there, and overnight their spend alerts fired at all three providers. For many the charges reached hundreds of dollars, and a few passed $1,000. Anthropic and Google blocked the keys they thought were exposed, and OpenAI is refunding the credits used in the attack.
The key does not know who is holding it
A provider bills whoever presents the key. It cannot tell the developer from a thief, and it adds up the cost at the end of the billing cycle, so the owner learns about a theft only when a charge or an alert arrives. Criminals have built a business on that delay: they feed stolen keys into proxy services that resell AI access to other people, which means a stolen key can be spent at full speed all day. Those services can produce hundreds of thousands of dollars in usage fees.
This time the user did nothing wrong
The beginner in the 2015 bitcoin case published his own key by accident. OpenCode's users did something ordinary: they saved a key in a tool's online workspace so it would be there when they needed it. The leak came from a system they never knew existed, on the night the team was already under attack. The open-source app and command-line tool were not affected. Only the Console held the keys.
So your safety is only as good as the weakest place your key is stored, and you cannot inspect those places. That is why the protection has to sit at the provider, where the money actually leaves.
A cap stops it, an alert does not
OpenAI lets an organization or a single project set a monthly limit, and if you turn on the hard version, requests fail once the limit is reached. Alerts remain separate and enforce nothing.
Take a small design agency that spends about $300 a month on AI across four tools, all using one company key. If that key leaks, the thief can spend until someone notices. If the agency instead makes four projects with a key each and a hard cap of $100 on each, a leak of one key costs at most $100, and the other three tools keep working. The price is that a legitimate tool can hit its cap and stop mid-month, which is an annoyance that costs far less than a $1,000 surprise. Check the billing page of each of your other providers for the same setting.
Your own AI may refuse to help during the attack
OpenCode's team ran AI agents around the clock to defend itself against attackers who had been trying to get in for 48 hours. The models helped for a while, then refused to work when the malicious code they were asked to examine tripped their safety filters. Hugging Face hit the same wall in July, when it tried to investigate the intrusion by OpenAI's agents using commercial models. OpenCode eventually got into Daybreak Blue, a program in which OpenAI gives approved security defenders models that refuse security work less often.
A small business should not plan on being approved on the night of an attack. In the middle of an incident, the step that works for everyone is revoking the key at the provider, and it needs no AI at all. Before the next tool gets a key, give it its own, put a hard cap on it, and write down where to revoke it.