A stolen AI API key let an attacker consume roughly $600,000 worth of AI model usage over about three weeks in March 2026, and the victim did not notice until it was over. The victim was METR, an AI evaluation nonprofit, which disclosed the incident on August 31, 2026. The entry point was a single employee's experimental AI agent, running on a personal cloud server, with a login check that quietly stopped working.

METR had one advantage most businesses would not: the credits had been donated by the model provider, so no $600,000 invoice ever arrived. For a company in Canada or the US paying for AI usage on a corporate card, the same chain of events could mean a six-figure bill, a possible data exposure, and limited recourse.

This post explains what happened, who is exposed to the same risk, why attackers go after AI API keys specifically, what recourse a business may realistically have, and the controls that help keep the damage contained.

What Happened at METR?

A METR researcher ran AI agents on a personal Amazon cloud server (an EC2 instance), placed behind a Google sign-in page. The app had been "vibe-coded," meaning built quickly with AI assistance, and its login had a fail-open bug: when the check broke, it let every request through instead of blocking them. For several days, the agent sat on the open internet with no working login in front of it.

According to METR's disclosure and reporting from The Register and Dark Reading, the sequence went like this:

  1. Discovery. The attacker searched certificate transparency logs, the public records of newly issued website security certificates, for recently registered domains containing AI and agent-related keywords. Anyone can search these logs, and attackers use them to find fresh, often unfinished deployments.
  2. Access. Because the login failed open, the attacker reached the agent directly.
  3. Theft. The attacker prompted the agent to reveal its model provider API key, the secret string that authorizes and bills usage of an AI model. The agent had the key and handed it over.
  4. Persistence. The attacker added their own SSH key, a credential for remote command-line access, to the server. That gave them a way back in even if the app was fixed.
  5. Spend. Over roughly three weeks, the stolen key was used to consume about $600,000 in credits on publicly available models.

Two gaps kept it hidden. The key had no spending limit. And METR's internal usage dashboard did not display rate-limited requests (calls the provider throttled for exceeding volume limits), so the abuse blended into the normal, very high usage of METR's research work. METR also reported a separate, more sustained campaign in May 2026 that involved credential stuffing (trying passwords leaked elsewhere), attempted OAuth access grants, scanning of newly deployed services, and phishing of employees.

Who Is Actually at Risk From a Stolen AI API Key?

Any business where someone has created an AI API key is exposed, whether or not leadership knows that key exists. The highest-risk case is the METR pattern: an employee, acting in good faith, puts a company key into a tool running on a device or cloud account the company does not manage. No one in IT sees it, no one caps it, and no one is watching the bill.

In practice, that population includes:

  • Developers building internal tools or prototypes with AI features.
  • Operations and marketing staff connecting AI to spreadsheets, CRMs, or automation platforms.
  • Employees running personal AI agents, such as the open-source tools covered in our post on OpenClaw and similar AI agents.

This is shadow AI with a billing account attached. Quickly built tools add to the risk: as noted in our piece on vibe coding, AI-generated apps often work well enough to ship while skipping security basics such as failing closed, meaning blocking access when a check breaks.

Why Is a Stolen AI API Key So Dangerous for a Business?

An AI API key works much like a credit card for computing power. Whoever holds it can run up charges billed to the key's owner, at machine speed, around the clock. Unlike a stolen password, the damage does not require the attacker to touch your data. The loss can be the bill itself, and with usage-based billing there is no natural ceiling unless the business sets one.

The scale is documented:

  • METR: about $600,000 in usage over three weeks, from one key.
  • A three-person software company in Mexico that normally spent about $180 a month on Google's Gemini API was hit with $82,314 in charges in about 48 hours in February 2026 after its key was stolen.
  • Security research firm Sysdig, which named this attack pattern "LLMjacking," estimated that abuse of stolen cloud AI credentials can generate more than $46,000 per day in charges for the victim.

For a small or mid-sized business, a bill of that size can exceed a quarter's profit. The bill may also be only the most visible cost. If the compromised agent had access to email, files, customer records, or internal systems, the incident may be a data breach as well, with the investigation and notification obligations that can follow.

Why Do Attackers Steal AI API Keys?

Attackers steal AI API keys because a working key converts directly into money and capability at low risk to them. There is no ransom to negotiate and no stolen data to sell. The key gives them access to expensive frontier models billed to someone else, and it sidesteps the identity checks and abuse monitoring they would face on an account in their own name.

Research from Sysdig and the Cloud Security Alliance points to four common motives:

  • Resale. Stolen keys are pooled and sold as cheap, anonymous access to premium AI models. The buyer gets discounted AI; the victim pays full price.
  • Anonymity. Using someone else's account means the provider's abuse monitoring points at the victim, not the attacker.
  • Offensive work. Researchers have documented stolen AI compute being used to write phishing content, generate exploit code, and run attackers' own AI agents against new targets.
  • A foothold. AI agents are often connected to other systems. As at METR, where the attacker planted an SSH key, the API key may be the first prize rather than the last.

How the target was found matters as much as why. Attackers are not choosing victims by company size. They run automated searches for anything that looks like a freshly deployed AI tool, so a small business with one experimental agent can be found as quickly as a large enterprise.

What Recourse Does a Business Have After a Stolen AI API Key?

Often less than leaders assume. AI and cloud providers' commercial terms generally hold the customer responsible for activity on their account, and a refund for fraudulent usage is typically at the provider's discretion rather than guaranteed. Some businesses have recovered their money; others have struggled to. The options below are general information, not legal or insurance advice.

  • The provider. Report the compromise immediately and request a billing review. The developer hit with the $82,314 Gemini bill reported getting nowhere with support at first, and other affected Google users described similar struggles. Google later reversed charges for at least some of them and added project-level spend caps in response to complaints. Fast reporting and a clear record of your response may help; neither guarantees an outcome.
  • Your card issuer. A chargeback is generally a weak option. The charges came from an account your business opened and authorized, and disputing them may lead the provider to suspend the account, which can disrupt anything that depends on it.
  • Cyber insurance. Some policies include "utility fraud" or "cryptojacking" coverage for abuse of paid resources, but many of those definitions were written with phone systems and electricity in mind, not AI usage bills. Whether a policy responds depends on its wording, so it is worth raising the question with your broker before an incident. Our guide to what cyber insurers check before quoting covers how those conversations typically go.
  • Law enforcement. Reporting to the Canadian Anti-Fraud Centre or the FBI's Internet Crime Complaint Center creates a record that can support provider and insurance claims, though recovering funds from anonymous key resellers is unlikely.
  • Regulators. If the agent could reach personal information, breach-reporting obligations may apply under PIPEDA and provincial privacy laws in Canada or state breach-notification laws in the US. Qualified legal advice early in the process is important here.

Once the credits are spent, recovering them is uncertain at best. Prevention is where a business has the most control.

How Can a Business Limit the Damage From a Stolen AI API Key?

One of the most effective measures is a hard spending cap on every AI API key and project, set close to real expected usage. A cap does not prevent theft, but it limits how much a stolen key can cost before it stops working. Beyond that, the aim is to make keys hard to reach, quick to flag when abused, and short-lived.

Cap and watch spend

  • Set hard monthly limits on every provider account, project, and key where the provider supports them. Several major providers, including Google after the Gemini incidents, now offer project-level caps or prepaid billing.
  • Configure spend alerts at thresholds such as 50%, 80%, and 100% of normal usage, sent to a named person who will act on them.
  • Review usage by request volume and errors, not only dollars. METR's gap was a dashboard that did not show throttled traffic.

Keep keys away from the agent

  • Avoid giving an AI agent a raw key it can read. Route calls through a gateway that holds the key on the agent's behalf, so a prompt asking for the key has nothing to return.
  • Issue separate keys per tool and per person, with the narrowest permissions available, so one leak does not expose everything.
  • Store keys in a dedicated secrets manager, not in code, configuration files, chat messages, or shared documents.

Control where AI tools run

  • Set a clear rule that company keys and data do not go on personal devices or personal cloud accounts. This was the first policy METR changed. Our guide to writing an AI usage policy covers how to word it.
  • Keep an inventory of every AI key the business has issued and who owns it, and revoke any key without a named owner.
  • Require any internet-facing AI tool to sit behind company single sign-on with MFA, and test that it fails closed.
  • Limit what an agent can do on its own. Our post on AI agents that deleted databases covers the guardrails that apply here too.

Plan for the bad day

  • Rotate keys on a schedule, and immediately when someone leaves or a tool is retired.
  • Add "AI key compromise" to your incident response plan: who revokes the key, who contacts the provider, who checks what the agent could reach, and who notifies the insurer.
  • After a suspected compromise, check the server for anything the attacker left behind, such as new SSH keys or user accounts, not only the key itself.

What Canadian and US Business Leaders Should Take From This

Most executives on either side of the border cannot say how many AI API keys their business has issued, where those keys are used, or what each one is capped at. Those three unknowns are most of the risk, and none of them requires technical expertise to ask about. Five questions for an IT lead or MSP can surface the answers in a single meeting:

  1. How many AI API keys have we issued, across which providers, and who owns each one?
  2. What is the hard spending cap on each, and who receives the alert as it is approached?
  3. Are any of our keys used on personal devices or personal cloud accounts?
  4. Can any AI agent we run read its own key, or reach email, files, or customer data?
  5. If a key were stolen tonight, how long until we would know, and what does our cyber policy say about the resulting bill?

AI API Keys Are Money, and Attackers Are Scanning for Them

The METR incident started with one good-faith experiment and one small bug at an AI research group. AI API keys carry real financial value, AI agents may hand over what they hold if asked, and attackers search for both automatically. A spending cap set in advance is one of the few controls that still works after everything else has failed. If you are not sure where your business stands, our free quick security assessment takes about five minutes.

This article is intended for general informational purposes only and does not constitute professional security, legal, insurance, or compliance advice. Details about the METR incident and related API key thefts are based on public reporting and the organization's own disclosure as of the date of publication and may evolve as more information becomes available. Organizations should consult qualified cybersecurity, legal, and insurance professionals before making operational changes or decisions about coverage and breach obligations based on this article.