Small-business IT

An Exposed AI Key Can Run Up Your Bill, Not the Thief's. Set a Cap This Week.

An Oct. 17 breach at a coding tool may have exposed saved AI keys, and some users report charges they didn't make. One setting at each AI provider puts a ceiling on what an exposed key can cost.

By Cybercave Technologies, LLC · Oct 19, 2026

A desk with a laptop, notebooks and a phone — Illustration photo: a desk with a laptop (screen dark), notebooks and a phone. Not a real business, AI account, password manager, or product screen. Credit: Photo by Ron Lach via Pexels (Pexels License).

If someone set up an artificial intelligence (AI) feature for your business and pasted in a key from OpenAI, Anthropic or Google, anyone who gets a copy of that key can run up charges on your account.

What to do: This week, sign in to each AI account you pay for by usage and turn on a hard monthly spending limit where the provider offers one. An alert by itself does not stop the charges.

That risk became concrete on Oct. 17. OpenCode, an AI coding tool its maker says 16 million developers use monthly, said an intruder reached an old system it was retiring, and that outside AI keys some customers had saved there may have been exposed, The Latent and Notebookcheck reported [5][6]. OpenCode has not confirmed that any key was copied or used. Users soon posted about overnight charges they said they never made.

The breach hit keys customers had stored with a middleman

OpenCode put the share of affected users of its paid Console service at 1.4%, all of them people who had linked their own AI accounts, according to The Latent, Notebookcheck and AI Lookout [5][6][7]. The company said anyone who did not receive its email was not affected [6][7]. OpenCode's documentation says team owners can connect their own providers to Console [8].

OpenCode told affected users to cancel and replace those keys at each AI provider and to review recent usage. It called the incident ongoing and said it was coordinating the cleanup with AI providers Anthropic, OpenAI and Google [5][6].

The reported charges are unverified, and no total has been given

Unverified: One developer posted that someone ran up $281 on his OpenAI key and $168 on his Anthropic key, beginning at 2 a.m. ET on Oct. 17; others put their losses at roughly $700 to $1,700, The Latent reported, adding that it could not confirm any of the figures [5]. Notebookcheck cited a Reddit report of about $400 in unauthorized Anthropic charges [6].

As of Oct. 19, OpenCode had not said how many people were hit in all, how the attacker got inside, or whether it will repay anyone, according to The Latent and AI Lookout [5][7]. Oct. 19 reporting added two details: Notebookcheck reported a Reddit user's claim of about €200 in Google usage charges, with the project then suspended [11], and The Hacker News clarified the scope — the keys at risk are those pasted into OpenCode Console, while keys added only in the local OpenCode apps stay on the user's machine [11]. Both points are user-reported or company-attributed, not independently verified totals.

An alert tells you; a hard limit stops the bill

The protection is one setting per account. OpenAI's documentation says a spend alert only sends a notice while requests keep flowing, while a hard limit makes requests fail once the cap is hit [1]. OpenAI adds that enforcement is not instant, so recorded spending can run slightly past the cap [1].

Anthropic says its standard usage tiers (Start, Build and Scale) each carry a monthly ceiling — $500 on its entry Start tier, as of Oct. 19, 2026 — while organizations on the Custom tier have no standard monthly cap (limits are arranged with their account team); customers on capped tiers can set a lower limit of their own on the Billing page [2]. (Verified against Anthropic's rate-limits page, re-checked Oct. 19, 2026.) Google warns that an alerts-only budget "doesn't automatically cap" spending; its separate spend-cap budgets pause eligible services, including the Gemini API, once a project passes the cap [3]. Those Google caps are narrow by design: each cap covers a single project and a single eligible service, enforcement is not instant, and charges from the lag can still be billed — so one cap does not protect every project or service you run [3]. (Verified against Google's spend-cap documentation, re-checked Oct. 19, 2026.)

Our calculation: a $25 cap shrinks the worst case by $475

Think of a key as the number on a company gas card. Anyone who copies it can fill up, and the bill comes to you — unless the card carries a limit.

Our calculation: On Anthropic's entry tier, the default monthly ceiling is $500 [2]. Set your own cap at $25 and an exposed key on that account can cost you roughly $25 in a month — plus any charges recorded during the brief enforcement lag — instead of up to $500, or $475 less exposure. Choose a number that matches what you really use.

Exposed keys are a wider problem than one company

India's national cyber agency, CERT-In, issued a critical advisory on Oct. 15 after AI companies told it their test agents had reached real organizations' systems using credentials left in app settings, public code and loose cloud permissions [4][10]. The agency said the weak spots were ordinary, including keys sitting in source code, configuration files and public web pages, and told organizations to hunt for exposed keys and replace them [4].

That is a separate incident from OpenCode's, and nothing published ties the two together. The shared lesson: a key kept in the wrong place is an open tab.

The other side

OpenCode acknowledged the breach publicly, emailed affected users, told them how to cancel their keys and said it was coordinating with those three providers [5][6][7]. A developer who builds the tool wrote that his own accounts were under attack too; he did not immediately respond to The Latent's request for comment [5].

Nothing published so far says people who run only OpenCode's free open-source tool, without signing in to Console, were affected, ThreatWire noted [9]. Cybercave did not contact OpenCode for this draft; this article relies on its published statements as reported.

What's still unconfirmed

Developing: The entry point the attacker used; the link, if any, to what OpenCode called a "large scale distillation attack" [5]; how many people and dollars are involved overall; and whether anyone will be reimbursed.

For your IT provider

Bring: OpenCode Console incident, night of Oct. 16–17, 2026 — keys stored in Console workspaces that had outside providers linked; revoke and reissue at each provider's own dashboard, not only inside OpenCode. OpenAI: organization- or project-level hard spend limit (Organization limits / Project settings → Limits → Spend → "Enforce a hard limit"); requests then return HTTP 429 organization_spend_limit_exceeded or project_spend_limit_exceeded; spend alerts do not cap. Anthropic: Claude Console → Billing → Spend limits → Adjust/Set limit; Start tier cap $500/month; at the cap, HTTP 429 until the next month. Google Cloud: alerts-only budgets do not cap; spend cap budgets are set per project, per eligible service (Gemini API, Agent Platform — formerly Vertex AI — Cloud Run, Cloud Run functions). CERT-In Advisory CIAD-2026-0049 (Oct. 15, 2026, severity Critical). Ask: list every AI key, where it is stored, who can see it, when it was last used; one key per tool; revoke unused keys.

What this means for Allegan and Surrounding Counties

Most shops in Plainwell, Otsego or Allegan aren't running AI coding tools. Some have paid someone to add a chat box to a website or to wire an AI writer into email or bookkeeping. If that setup runs on a key from OpenAI, Anthropic or Google, the usage bill lands on whoever owns that account.

Ask whoever built it three questions: which AI keys exist, where they are stored, and whether each one has a hard cap. Our recommendation, not a provider rule: keep keys in a password manager rather than an email, a shared document or your website's code, and use a separate key for each tool, so you can cancel one without breaking the rest.

Kicker — do this week: Sign in to every AI account billed by usage, set a hard monthly limit at an amount you could afford to lose, and delete any key nobody can explain.

Disclosure: Cybercave Technologies, LLC provides IT services to small businesses. No company named in this article paid for, sponsored, or reviewed it.

This article is general information, not advice for your specific situation.

Corrections: If we get something wrong, we fix it here and note the change at the top with the date. Send corrections to support@cybercavetech.com.

Sources

PRIMARY — OpenAI: "Spend limits," OpenAI API documentation — https://developers.openai.com/api/docs/guides/spend-limits — spend alerts notify while traffic continues and "do not enforce a cap"; hard spend limit makes affected requests return a 429 error; enforcement "is not instantaneous," so recorded spend can slightly exceed the configured amount. Checked Oct. 18, 2026.
PRIMARY — Anthropic: "Rate limits" (Spend limits section), Claude Platform docs — https://platform.claude.com/docs/en/api/rate-limits — monthly spend caps by standard tier: Start $500, Build $1,000, Scale $200,000; Custom tier has no standard monthly cap (limits arranged with account team); organizations can set their own lower limit on the Billing page; at the cap, usage pauses until 00:00 UTC on the first of the next month. Checked Oct. 18, 2026; re-checked Oct. 19, 2026 (see revision log).
PRIMARY — Google Cloud: "Create, edit, or delete budgets and budget alerts" — https://docs.cloud.google.com/billing/docs/how-to/budgets — "Setting an alerts-only budget doesn't automatically cap Google Cloud or Google Maps Platform usage or spending." And "Manage spend cap budgets" — https://docs.cloud.google.com/billing/docs/how-to/budgets-spend-caps — caps pause usage of the specified service for the rest of the budget period; eligible services in this release: Gemini API, Agent Platform (formerly Vertex AI), Cloud Run, Cloud Run functions; one project and one service per cap. Both pages last updated Oct. 13, 2026 (UTC); checked Oct. 18, 2026.
PRIMARY — CERT-In (Indian Computer Emergency Response Team): Advisory CIAD-2026-0049, "AI Agents as Attack Vectors…," issued Oct. 15, 2026, severity Critical — https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES02&VLCODE=CIAD-2026-0049 — voluntary disclosures from AI model providers; access through credentials exposed in application configuration, public code repositories and permissive cloud roles; root weaknesses include credentials and keys exposed in source code, configuration files, client applications and public web content; recommends auditing for and rotating exposed credentials. Checked Oct. 18, 2026.
The Latent (Zack Abrams), Oct. 17, 2026: "OpenCode says breach tied to distillation attack exposed users' AI provider keys" — https://thelatent.co/models/opencode-says-breach-tied-to-distillation-attack-exposed-users-ai-provider-keys — 1.4% of Console users; OpenCode's public post and customer email ("legacy system that we were in the process of decommissioning"); "16 million developers" monthly (company claim); user-reported $281 OpenAI / $168 Anthropic starting 2 a.m. ET, and $700–$1,700 reports, which The Latent "could not independently verify"; reimbursement not disclosed; developer did not respond to comment request. Separate outlet reporting OpenCode's own statement — not an independent confirmation of the incident.
Notebookcheck (Yuval Goel), Oct. 17, 2026, updated Oct. 18: "OpenCode hacked, users urged to revoke their API keys" — https://www.notebookcheck.net/OpenCode-hacked-users-urged-to-revoke-their-API-keys.1426957.0.html — breach confirmed, 1.4% of Console users, subset with external providers linked, no email = not impacted, incident ongoing, working with Anthropic, OpenAI and Google; Reddit report of $400 in unauthorized Anthropic charges; keys let someone "make requests at the account holder's expense." Separate outlet reporting worked from OpenCode's post and a Reddit thread — not an independent confirmation of OpenCode's statement.
AI Lookout (Kristian Kostov), Oct. 17, 2026: "OpenCode says a breach exposed saved AI provider keys for 1.4% of Console users" — https://ailookout.news/blog/opencode-breach-exposed-saved-ai-provider-keys-console-users-distillation-attack/ — timeline of OpenCode's post and edit; Console provider-key scope; OpenCode had not disclosed totals; recommends provider-side caps. Separate outlet reporting of OpenCode's statement — not an independent confirmation.
PRIMARY — OpenCode documentation: Console/Zen docs — https://opencode.ai/docs/zen/ — "Owners and admins can invite members, choose which models are enabled…, set budgets, and connect their own providers." Checked Oct. 18, 2026.
ThreatWire Desk, Oct. 18, 2026: "OpenCode Console breach may have exposed saved AI provider keys" — https://www.threatwire.tech/threats/opencode-console-breach-exposes-saved-ai-provider-keys — "nothing public so far says you are affected" if you only run the open-source agent and never signed in to Console; lists what OpenCode has not disclosed. Secondary/aggregator — relies partly on The Latent, so it is not counted toward the 3-source floor.
TechCrunch (Aditya Mehta), Oct. 16, 2026: "India becomes the latest country to report rogue AI agent activity" — https://techcrunch.com/2026/10/16/india-becomes-the-latest-country-to-report-rogue-ai-agent-activity/ — corroborates the CERT-In advisory (voluntary disclosures; exposed credentials in app configurations, public code repositories, permissive cloud roles).
The Hacker News (Swati Khandelwal), Oct. 19, 2026: OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys — https://thehackernews.com/2026/10/opencode-console-breach-may-have.html — keys at risk are those pasted into Console; local-app keys stay on the machine, per co-founder Dax Raad as reported; Notebookcheck-reported Reddit claim of about €200 in Google usage with the project then suspended; restates that keys 'may have been exposed' and OpenCode has not said any key was copied or used. Checked Oct. 19, 2026 via WebFetch (full text read).