AI API key leaked? What it costs and what to do

An API key is the password your software uses to talk to an AI service such as OpenAI, Google Gemini or Anthropic's Claude. It also works like a card number, because every request made with it is billed to your account. Automated scanners hunt for these keys around the clock. An API key leaked on GitHub, in a website's code or inside an app can be put to work within minutes, and whoever finds it gets an assistant that works through the night, never takes a break and sends every invoice to you.

Anyone holding your key can run AI requests on your bill until you delete it. Replace and delete the key first, then check your usage, gather evidence and ask the provider for a refund. Refunds are not guaranteed. A hard spending cap limits what a thief can spend next time.

We read OpenAI's, Anthropic's and Google's own pages for this post on November 3, 2026, along with Google's new report on stolen AI access and the cases below. We didn't leak a key to test any of this, for reasons that will be clear by the second section.

Photo by Antoni Shkraba on Pexels

What happens if your API key is leaked

Anthropic puts it plainly on its key safety page: "Much like a credit card number, if someone obtains and uses your API key, they incur charges on your behalf." In the cases we read, thieves spent most of it on the expensive models, for images, video and voice.

These are cases owners have reported, in their own words, on Google's and OpenAI's developer forums or to the press:

• A family tire shop in Brazil. Its Google Cloud bill was usually about $44 a month. On June 10, 2026, an old Google Maps key was used for nearly 600,000 Gemini requests, and the owner wrote that $7,500 was charged to the card within an hour, with $6,500 more pending.
• A three-person company in Mexico. It normally spent $180 a month. A stolen Google key ran up $82,314.44 in two days in February 2026, mostly on Gemini's image and text models, The Register reported.
• A small app for video creators. Its Gemini key was built into the website code. A scanner pulled it out and spent about $2,200 in a single burst in April 2026.
• A developer's portfolio project. An OpenAI key pushed to a public GitHub repository in September 2026 ran up $296.99, the developer wrote, "before I even received the spend alert."

Big companies get hit harder. On November 2, Google's security team published a report on criminals hijacking companies' AI access, a practice it calls LLMjacking. It saw fraudulent charges above $100,000 in a single day, and some companies reached $1 million before they cut the attackers off. One group made more than 500,000 requests in under eight hours on stolen keys to supply a cut-price AI service that sold "unlimited" access for about $60 a month. The report's victims were large companies, but one of its methods applies to everyone: collecting keys from public GitHub repositories and testing each with a tiny request so nobody notices.

How API keys get leaked or stolen

In every case above, the key was sitting somewhere public. These are the usual spots.

Photo by Alicia Christin Gerald on Pexels

Code pushed to GitHub. A key typed straight into a file goes public the moment the repository does. GitGuardian's 2026 report found that leaked keys for AI services on public GitHub grew 81% in 2025. Deleting the key from the file later doesn't fix it, because it stays in the repository's history.

Website and app code. Anything that runs in a visitor's browser can be read by that visitor. The $2,200 case above used a build setting that copies the key into the public JavaScript file, where anyone could find it in seconds. Desktop and phone apps aren't safe hiding places either, since a key shipped inside software can be pulled back out. One developer who kept an OpenAI key inside a desktop app, and never put it on GitHub, still got OpenAI's email saying the key "was leaked" and had been disabled "with immediate effect." Sites made with AI app builders are a big source. In a 2025 scan of about 130,000 published sites from 13 such platforms, Red Hunt Labs found at least one exposed secret on 1 in 5, and Gemini keys made up 72% of the exposed AI keys.

An old Google Maps key. For years, Google told developers that Maps and Firebase keys weren't secret and could sit in a web page. Then Gemini arrived. Researchers at Truffle Security showed that switching on the Gemini API in a Google Cloud project let every unrestricted key in that project use Gemini, without warning,, and found 2,863 such keys on public websites. That's what hit the tire shop: its key had spent five years helping customers find the shop, then it learned to generate images. Google has since changed the rules. Its Gemini key page says the API now rejects unrestricted standard keys, has blocked long-unused ones since May 7, 2026, and makes new keys in AI Studio Gemini-only by default.

Tools you hand your key to. Anthropic warns that giving your key to a third-party tool gives that tool's developer access to your account. Those tools can be breached too. On November 1, Trigger.dev, a platform for running AI tasks, disclosed that an attacker had reached environment variables, the settings where apps often keep their keys, for some customer organizations. It had not published more detail by November 3.

Chats and messages. A key pasted into a support ticket, a team chat or an AI chatbot is a copy you no longer control. If that chat gets shared, the key goes with it, as our guide to ChatGPT shared links explains.

What to do in the first hour

Speed decides the bill, so do these in order.

1. Replace the key, then delete the old one. Create a new key, put it wherever your app reads it, and delete the leaked key. If the leaked key is being used right now, delete it first and accept some downtime, since a few minutes offline costs less than a few more minutes of someone else's image generation.
2. Check usage and billing. Look for models you never use. In the cases above, the giveaway was image, video or voice models in an app that only handled text.
3. Save the evidence. Take screenshots of the usage charts, the billing breakdown and any alert emails, with times. You'll need them for the refund request.
4. Find every other copy. Search your code, its history, your hosting settings, any automation tools and old shared chats. A key you replace but leave in another tool is still a working key.
5. Set a spending cap before you put the new key to work (see below).

Will you get a refund?

Maybe. Outcomes in the cases we read ranged from a full charge to a partial refund, and nobody published a clear rule.

OpenAI says on its fraudulent charges page that unauthorized charges must be validated before any refund, through its Fraudulent Activity webform. It also tells you to contact your bank promptly, and says it can't issue its own refund while a dispute with your bank is open. Weigh that before you file both.

Google handles it as a billing dispute opened from the Google Cloud console, a Google staff member told one owner on its forum. That owner, with a $4,368 bill, said 26 days later that billing support had sent only a template reply, and moved to a bank chargeback. Another developer reported a partial refund after about six weeks. A startup charged around $80,000 said Google wrote off 75% of it. The $82,000 company in Mexico said Google pointed to its shared responsibility model, under which Google secures its platform and customers secure their own keys.

Anthropic's key pages we read say to delete a compromised key at once. They don't describe a refund process.

Whichever provider you use, open the case the same day, attach the evidence and keep asking in writing. A clear spike on models you never use is the strongest case you can make.

How to cap your bill: OpenAI, Gemini and Anthropic spend limits

A spending cap won't stop a theft. It limits the size of the bill. OpenAI's key safety page says "spend alerts alone don't stop API traffic," so an alert that arrives at 3 a.m. is a smoke alarm that texts you while the kitchen burns.

Google introduced its project spend caps in March 2026, alongside a monthly ceiling for each billing account that rises with its usage tier. Set each cap a little above a normal month's spending. A cap at your usual bill can cut off real customers in a busy month, and a cap at fifty times your usual bill protects nobody.

How to protect an API key

The providers' advice comes down to a few habits:

• Keep keys on a server. OpenAI says never to put a key in browser or mobile app code, and to send requests through your own backend instead. If your app runs entirely in the browser, it needs a small server to make the AI calls.
• Store keys in environment variables or a secrets manager, never in the code itself, and keep files such as .env out of your repository.
• Turn on secret scanning. GitHub's push protection can block a commit that contains an OpenAI or Anthropic key before it goes up.
• Restrict what a key can do. Limit Google keys to the one API they need, use OpenAI's expiry dates and IP allowlisting, and give each project its own key, so one leak doesn't take down everything.
• Don't paste keys into AI chats. Is it safe to share an API key with ChatGPT or Claude? Treat it like sharing a password. The same goes for client details, as we cover in putting client information into ChatGPT.

If you build AI features for clients

Freelancers add a question nobody else has to answer: whose key is it? If you build a client's chatbot on your own account, a leak lands on your card, and then you get to explain the line item.

• Use the client's account and card. Ask them to invite you as a member. OpenAI's terms don't allow sharing keys, and members get their own.
• One project and one key per client, each with its own spending cap, so you can switch off one without touching the others.
• Put it in the quote. List AI usage as its own line, billed to the client's account at cost, and add the agreed monthly cap and who changes the key after a leak to the terms. Our quote generator has room for both.
• Check what you shipped. If you built the site with an AI app builder, open the published page in a browser, view the source and search for the start of your key. Google keys begin with AIza.

Expect phishing, too. Google's report describes a fake sign-up portal for a group of AI users that got people to paste a live access token into it. Treat any page that asks for a key or token that way, and our guide to spotting AI scams covers the patterns.

How we made this: researched and drafted with AI assistance, with any figures checked against their sources and the post reviewed by Hamza before publishing.

Frequently asked questions

Sources