Contents7
An API key is an access card a program presents to a service to be served, and billed. In an AI project, these cards multiply quickly: one per model provider, one per automation, one for last week’s prototype that is still running. Each one opens a meter paid for by the company. Stolen, it opens the same meter to someone else.
This piece from our Infrastructure and cloud section looks at this risk from the angle that upsets finance teams: the bill. Where keys leak in an AI project, what a stolen key can cost, how to limit the damage before the leak even happens, and what to do in the first hour.
In short
Publicly exposed AI service keys jumped 81% in one year, according to GitGuardian.
A stolen key is used to consume models at your expense, or even to resell access to them: this is called LLMjacking.
One key per use, restricted permissions and a spending cap turn a costly leak into a contained incident.
A key that has been visible anywhere is treated as lost: revoke it, replace it, check what it was used for.
The best key is the one that the code, the browser and the model never see.
Why AI projects multiply exposed keys
Because they move fast and stack services. An internal assistant calls a model, a search engine over your documents, an automation tool; each building block needs its key, and the prototype that was meant to last a week goes into production with the key pasted wherever it was handy.
GitGuardian’s latest report on secrets sprawl measures the scale of the problem:
AI service secrets exposed
in one year for secrets of AI-related services
of valid secrets detected in 2022 were still working four years later
The last figure is the most worrying: a leaked key is almost never changed. It remains usable for years by whoever picked it up.
What a stolen key really costs
A stolen email key exposes data. A stolen AI model key also exposes a budget. In May 2024, Sysdig’s research team described an attack it called LLMjacking: cloud credentials stolen through a flaw in an unpatched website were used to run hosted models and resell access to them, at the victim’s expense. In the worst case Sysdig calculated, consumption exceeded 46,000 dollars a day.
OWASP, the reference foundation for application security, lists this risk in its 2025 ranking of risks for AI applications as unbounded consumption, and gives it a telling nickname:
Definition
Denial of wallet
An attack that exploits the pay-per-use billing of AI services by triggering such a volume of calls that the bill becomes unsustainable for whoever pays it.
The countermeasure OWASP recommends is nothing exotic: request limits, per-user quotas, and monitoring that alerts on unusual consumption. In other words, caps set before the incident.
Where keys leak in an AI project
Four places come up again and again.
- Code sent to the browser or the mobile app. A prototype calls the model directly from the page: the key travels with it, readable by any visitor. Google says so plainly in its best practices for API keys: never put a key in client code or in a code repository; the server adds it to the request.
- The code repository, history included: removing the key from the file does not erase it from previous versions.
- Collaboration tools: chat, tickets, shared documents. GitGuardian estimates that 28% of leaks happen exclusively outside code repositories.
- Instructions and documents given to a model: a key an AI agent reads is a key it can repeat. Our article on the secrets vault explains how an agent can use a key without ever seeing it.
Watch out
A client learned this the hard way
On their project, access tokens had been written in plain text in files tracked by the code repository. The fix followed the order this situation demands: revoke each token, create a new one, replace it everywhere it was used, then purge the repository history.
Limiting the damage before the leak
Nobody can guarantee that a key will never leak. You can, however, decide in advance what it will allow the day it does.
A key that is expensive when it leaks
One key for every use
All the account’s permissions
No spending cap
Nobody watches consumption
A key that leaks without ruining anyone
One key per use, per project or per agent
Only the permissions and services needed
A monthly cap and an alert before the cap
Consumption tracked, use by use
In practice:
- One key per use. The day one leaks, you cut it off without stopping the other projects, and the log immediately shows which one is affected.
- Restrictions on each key. On Google Cloud, for example, a key can be limited to certain services or applications, and Google sums it up: a restricted key reduces the impact of a compromised key. Check what each of your providers allows.
- Caps and alerts. A budget per use, an alert at 50 or 80% of that budget, and an automatic stop at the cap when the provider offers one. Our article on AI costs, tokens and routing explains how to plan that budget use by use.
- Regular clean-up. Keys nothing uses any more are deleted, and the others are renewed at regular intervals.
- Detection at the source. Since February 2024, GitHub blocks known secrets from being pushed to public repositories by default; GitHub said at the time it had detected over a million leaked secrets on public repositories in the first eight weeks of the year.
From the field
Our own AI agents publish code without ever holding a key: it is added on the way by the network layer, and never enters their working environment. An agent tricked by a hidden instruction would therefore have no key to give away.
An agent’s permissions are split up like an employee’s: our guide to enterprise AI governance explains how.
The first hour after a leak
When a key has been seen where it should not have been, the question is not whether someone picked it up. Assume they did.
The first hour after a key leak
- Revoke
The exposed key is cut off at the provider.
- Replace
A new key, with restricted permissions, takes its place wherever it was used.
- Check
The provider’s log and bill show whether it was used, and since when.
- Clean up
The key is removed from code history, messages and documents.
Order matters: revoke first, even if a service stops for a few minutes. A key that stays valid while you look for a clean way to replace it keeps costing money. If personal data could have been read with the key, the question of notifying the data protection authority also arises, within the 72-hour deadline that applies to a personal data breach under the GDPR.
Where to start
- List your AI keys
Provider, use, person responsible, creation date.
- Delete the ones nothing uses any more
And change the ones that have travelled by chat or in code.
- Separate uses
One key per project or per agent, with only its own permissions.
- Set a cap and an alert
On every model provider account.
- Write the first-hour procedure
With the name of who is allowed to revoke.
Program keys belong in a secrets vault; people’s passwords in a team password manager. Both are part of the infrastructure foundation shared by your projects. The rest of the section covers neighbouring decisions: the five items that inflate a cloud bill, dedicated server, VPS or cloud, Kubernetes and mid-sized companies, monitoring, the disaster recovery plan, NIS2 in France, backing up your own server, self-hosted n8n in production, which tools to move out of SaaS first, the three-year cost of leaving SaaS, cloud migration without breaking things, dependence on the American cloud, the hardware to run an AI model yourself, managed or self-hosted Postgres and choosing a business email provider.
For a vault in your name that your AI uses without seeing the keys, see our AI secrets vault; for caps per use and a tracked budget, AI at the right cost; to host these tools yourself, our Leaving SaaS offer.
Frequently asked questions
How can we tell whether one of our API keys has been stolen?
Look at consumption at the provider: a sudden rise, calls at night, models you do not use or unusual regions are the most common signs. A spending alert set in advance tells you sooner than the bill. A key spotted in public code or a shared message is treated as stolen, even without any sign of use.
Who pays the bill if an attacker uses an AI key?
In practice, the bill goes to the account holder, since it was their key that authenticated the calls. A goodwill gesture is sometimes negotiated, with no guarantee at all. Hence the value of spending caps: they limit the loss, whatever the outcome of the discussion.
Can an API key go into a mobile app or a website?
No. Anything sent to the browser or the phone can be read by the user, even when hidden or compiled. The app calls your server, which adds the key and forwards the request to the provider, applying its own per-user limits along the way. Google recommends the same in its best practices.
Should keys be changed regularly if nothing has leaked?
Yes, at a reasonable pace, and immediately when a person or contractor who had access leaves. Regular renewal limits the lifetime of a key that might have leaked without anyone knowing. It is only painless if each key is stored in one place that feeds every tool.
Sources
- Sysdig, LLMjacking: Stolen Cloud Credentials Used in New AI Attack, May 2024 (new tab)sysdig.com
- OWASP, LLM10:2025 Unbounded Consumption (new tab)genai.owasp.org
- Google Cloud, Best practices for managing API keys (new tab)docs.cloud.google.com
- GitHub, Keeping secrets out of public repositories, February 2024 (new tab)github.blog
- CNIL, passwords: a new recommendation, October 2022 (new tab)cnil.fr
Sysdig, LLMjacking: Stolen Cloud Credentials Used in New AI Attack, May 2024
Read on sysdig.com(new tab)GitHub, Keeping secrets out of public repositories, February 2024
Read on github.blog(new tab)Jim · founder of Brain Plus AI
Also in infrastructure and cloud
Understand12 min
Secrets vault: your AI uses your keys without seeing them
Passwords sent by email, API keys forgotten in code, AI agents that could copy everything: these are the leaks we come across most often. And how a vault in your name lets your AI use your keys without ever reading them.
Practical guide7 min
Passwords: one password manager for the whole team
An "Access" spreadsheet, passwords sent over chat, a shared account nobody dares to change: a team password manager fixes all of it in one go. What it changes when someone joins or leaves, how to choose one, and where to start.
Practical guide10 min
The cost of AI in business: tokens, routing and forecasting
What you really pay when you use an AI through an API: input and output tokens, the context sent back with every call, an agent's turns. And a method to forecast the bill before you receive it.