AI API key theft vulnerabilities spark risk of massive cloud bills

On 2026-11-07, DEV Community published a piece (originally published at ConvertElementor) warning that AI API keys are being stolen and abused at high intensity by attackers. In one documented case, a single day of abuse produced a bill of $1 million. The article calls the practice 'LLMjacking' and stresses that it is not quiet, light use: stolen keys tend to be burned at maximum rate, often to resell access to LLMs or to run large workloads on someone else's account before the owner ever sees the bill.

Google and Mandiant are cited as having documented the pattern, but the account offered does not explain how the documentation was produced or when it was published, and it leaves open where the line is between isolated incidents and a broader trend. According to the article, keys typically leak through code, repos, logs and shared prompts, for example when a user pastes a key into a prompt or chat window, or when keys are committed to a code repository and then spread as that code is copied elsewhere. Snippets or stores of prompts that capture secrets can also retain keys.

The article ends with a warning to developers that AI API keys deserve the same safeguards as any database password. As of the available material, that recommendation is where the discussion stops: no additional sources are cited, no fix or patch is described, and developers are left with the general takeaway to treat such keys as sensitive credentials and keep them out of code, logs and prompts.