How stolen AI API keys get resold, and how to defend against it

On November 5, 2026, DEV Community's AI section published a guide describing how stolen AI API keys are packaged into cheap resale services and turned into an underground trading chain, with the bill ultimately borne by the account owner. The article illustrates the typical scenario: you check your cloud dashboard on a Monday and find that the bill for your AI project is 40 times higher than last week. Nothing large was shipped and there was no traffic spike, yet tokens you never used are being burned steadily. Such scenarios now appear frequently enough in incident reports that security teams treat them as routine. The article notes that through 2026, researchers and AI labs documented a working underground economy around one asset: the AI API key. Criminals steal these keys and resell them for profit. The piece also lists the typical signals of such incidents, such as a bill spike with no corresponding change in traffic, and outlines control measures that can actually reduce the risk. At this point only this single report is available, with no follow-up developments and no other sources to confirm or contradict the claims.