Why Did Your OpenAI Bill Jump to $40,000 Overnight?

Stolen AI API keys sell at 97% discounts on dark-web markets. How they leak, why they're cheap, and how to spot the theft before your bill explodes.

The Slack message that ruins a Friday usually starts with a screenshot of a graph. In this case it was a billing dashboard, and the line went from a flat, boring $200-a-day to a cliff face — $38,000 in about eleven hours, most of it burned overnight against a model the team barely used. No new deploy. No new feature. Just tokens, tens of millions of them, generated in a region nobody on the team lived in.

Nobody had broken the model. Nobody had jailbroken anything. Someone had simply found the key, and the key still worked.

This is LLM-jacking, and the reason it’s worth a postmortem right now is that Google’s Threat Intelligence Group just published a report documenting a functioning underground marketplace where compromised API access to major AI providers — Anthropic, Google’s own Gemini APIs, and OpenAI are all named — gets bought and resold at discounts that reach 97% off the legitimate token price. Not zero-days. Not model exploits. Credentials—the same attack that’s worked since APIs existed.

What actually leaks, and how

Strip away the “AI” framing and LLM-jacking is credential theft with a metered payout. What makes it distinct from garden-variety API abuse is the economics on the back end: an AI API key isn’t rate-limited to something trivial, it bills per token, and the compute behind it is expensive enough that stolen access has real street value. A stolen SaaS login lets you read someone’s CRM. A stolen model key lets you run a resale business on someone else’s card.

The theft vectors are depressingly familiar:

• Leaked .env files and hardcoded keys. Committed to a public repo, baked into a Docker image layer, shipped inside a mobile app bundle, or left in a Postman collection synced to the cloud. Scanners crawl GitHub for sk- prefixes within minutes of a push. Minutes.
• Phished or malware-infected developers. Infostealer malware — the same commodity RedLine/Lumma-class families that harvest browser cookies — happily grabs environment variables and config files. Your laptop is the perimeter, and it’s a bad one.
• CI/CD compromise. Keys sitting in pipeline secrets, exposed build logs, or a misconfigured runner. One over-permissioned GitHub Action and the key is out.
• Shared and forgotten keys. The proof-of-concept key from 2024 that got pasted into a shared doc and never rotated. It’s still valid. It’s always still valid.

The underground market operates through brokers who aggregate these keys, validate them, and list them by provider and remaining spend headroom. That validation step matters, and it’s the tell for how you get caught.

The 97% number is the whole story

Here’s the part worth sitting with. If stolen keys sell for 3 cents on the dollar of the access they grant, the supply is enormous. You don’t discount a scarce good by 97%. Diamonds don’t go on clearance. That price is what you charge when inventory is effectively unlimited and the only real cost is the risk that a given key gets revoked before the buyer finishes draining it.

So the discount isn’t a headline curiosity — it’s a supply signal. It tells you leaked AI credentials are a liquid, commodity market, which means your key isn’t special and won’t be targeted; it’ll just be swept up, validated in a batch, and sold by the pound. The attacker doesn’t know or care that it’s yours.

It also reframes the threat model. The immediate damage is billing fraud — someone reselling your rate limit. But the same valid key can read anything your integration can reach: fine-tuning datasets, files uploaded to the Assistants/Files APIs, prompt histories, and in agentic setups, whatever tools that key is wired into. A shared credential in a multi-agent system is also a prompt-injection vector, because now an outsider can push instructions through a trusted channel. Billing is how you find out. It’s rarely the worst of it.

Where this went wrong before the bill

Back to our $38,000 Friday. The postmortem wrote itself, because every failure was a missing control, not a clever attacker:

The key was a single organization-wide secret, used by three services and two developers’ laptops. It had no IP restrictions. Nobody had ever looked at the usage logs because the dashboard was somebody else’s job. There was no billing alert below the monthly budget cap — which was set high, “so we don’t get paged during launches.” The infostealer that grabbed the key off a contractor’s machine had done so nineteen days earlier. The broker validated it, listed it, and a buyer drained it. Every step was preventable and none of it required sophistication.

What to actually do Monday morning

Detection first, because you probably already have keys in the wild and don’t know it. Pull usage programmatically and look for the shape of theft: traffic at 3 a.m., models you don’t use, a spike in total tokens against a flat request count (long generations = resale).

1
2
3

# OpenAI: pull recent usage and eyeball the daily buckets
curl -s "https://api.openai.com/v1/organization/usage/completions?start_time=$(date -d '7 days ago' +%s)&bucket_width=1d&group_by[]=model" \
  -H "Authorization: Bearer $OPENAI_ADMIN_KEY" | jq '.data'

Set a billing alert that fires at a fraction of your budget, not at it. A cap that triggers at 100% of a generous monthly limit is a smoke detector wired to go off after the house is gone.

1
2
3
4
5
6
7
8
9
10
11
12
13
14

import os, datetime, urllib.request, json
​
# Cheap cron-able tripwire: hourly spend vs a sane baseline
BASELINE_HOURLY_USD = 15.0
THRESHOLD = 3.0  # alert if we're 3x normal
​
def hourly_spend_usd() -> float:
    # replace with your provider's usage/cost endpoint response
    ...
​
spend = hourly_spend_usd()
if spend > BASELINE_HOURLY_USD * THRESHOLD:
    # page a human; don't email a shared inbox nobody reads
    notify(f"AI spend anomaly: ${spend:.0f}/hr vs ${BASELINE_HOURLY_USD} baseline")

Then close the doors:

1. One key per service, never per human. Developers get keys through a broker/proxy that logs and scopes; they never hold a raw production secret. Attribution is impossible if everything shares one sk-.
2. IP allowlisting where the provider supports it. Bind keys to your egress IPs or NAT gateway. A key drained from a residential IP in another hemisphere should simply fail. This alone kills most resale.
3. Route through a gateway, not direct. Send provider traffic via your own proxy (or a service like an LLM gateway) so keys live server-side, you get per-request logging, and you can revoke centrally. Never let a key touch a browser, a mobile bundle, or a public repo.
4. Rotate on a schedule and on suspicion. 90 days as a floor, immediately on any laptop compromise or contractor offboarding. Keep rotation scripted so it’s a five-minute job, not a change-request saga — the reason keys never rotate is that rotating them is painful.
5. Scan your own history. Run a secret scanner (gitleaks, trufflehog) over your repos and image layers. The key you leaked in 2024 is what’s for sale today.

The uncomfortable lesson is that AI infrastructure inherited every bad habit of API secret management and added a metered, high-value payout on top. The attackers didn’t get smarter. The stakes got higher, and the defaults stayed lazy. A 97% discount is the market politely informing you that your key is not rare. Treat it like the liquid, saleable asset it now is — because someone already is.