The short version: Stolen AI API keys from OpenAI, Anthropic and Google are now being sold to power a criminal hacking tool, and the person who owns the key pays for every scan it runs. By default, a stolen key can run up a bill of $500 a month on Anthropic’s Start tier, $250 a month on Google’s Tier 1, and up to $5,000 a month on OpenAI once an account has bought $100 in credit (all read off the providers’ own pages on October 17, 2026). You can set a lower cap on all three. The catch the coverage skipped: the cap that stops the thief is the same switch that turns off your own AI tools until the first of the month.
So the fix is not one big cap. It is a small cap per tool, so a stolen key can only take one tool down with it.
What happened: a hacking tool that runs on your bill
Help Net Security reported on October 16 on research by Bitsight’s threat intelligence team, which tracked posts across 16 underground forums from February to August 2026. One seller on a restricted forum is marketing a tool called MONST3R-AI as an autonomous penetration testing platform. The buyer pastes stolen AI keys into a panel, sets a budget, and gives it a list of targets. The seller hosts no AI model of its own. The AI work runs on the stolen keys, so the bill lands on whoever owns them.
One detail stands out. The buyer of that tool sets a budget cap on your key. Has anyone set one for you?
We could not find Bitsight’s report on its own site, so those findings rest on Help Net Security’s account. Everything below comes from the providers’ own documentation.
Does a small business even have an AI API key?
More often than owners realize. An API key is the password software uses to buy AI on your account. Website chat plugins, automation tools such as Zapier or Make, and helpers a freelancer wires up often ask for your own key, and the charges go on your card. If someone ever set up “the ChatGPT thing” on your website, a key with your billing behind it probably exists.
Keys leak the same ways passwords do: committed to a public code repository, copied out of an infected computer by password-stealing malware (The Hacker News reported in September that stealer logs are now a source of hijacked AI access), or left sitting in a website’s front-end code where any visitor can read it. We covered the repository route, and the free check that finds it, when leaked credentials let four AI models into real companies.
How much can a stolen AI API key cost you?
Here is what each provider’s own documentation says, read on October 17, 2026: OpenAI’s usage tiers and spend limits guide, Anthropic’s rate and spend limits page, and Google’s Gemini API billing page. The default ceiling is the most an account can spend in a month before the provider steps in, if you have set nothing lower.
| Provider | Default monthly ceiling | Cap you can set per tool | Enforcement |
|---|---|---|---|
| OpenAI | $500 (Build), $5,000 after $100 in credit | Project hard limit | “Not instantaneous” |
| Anthropic | $500 (Start), $1,000 (Build) | Workspace limit, not on the Default workspace | Pauses until the 1st |
| Google Gemini API | $250 (Tier 1), $2,000 (Tier 2) | Project spend cap in AI Studio, marked experimental | Billing data can lag about 10 minutes |
Put that next to a real workload. Suppose a three-van plumbing company’s website chat normally costs $10 a month in AI usage. On an OpenAI account that has bought $100 in credit, a thief could spend 500 months of that usage before OpenAI itself stops anything. On Anthropic’s Start tier it is 50 months; on Google’s Tier 1, 25.
And “stops” is generous. OpenAI’s guide says enforcement “is not instantaneous, so recorded spend can slightly exceed the configured amount.” Google says billing data in AI Studio can be delayed up to around 10 minutes, and that you may see overages beyond your project cap. On Google’s own developer forum, a developer described a €600 monthly cap that ended at €1,006.55 across May 30 and 31; a Google staff member replied that a short delay before the cap takes effect could explain an overage of that size. A cap is a strong fence, not a wall.
Why the spend cap is also an off switch
When a cap is reached, every request on that account or project is refused, the thief’s and yours, until the limit is raised or the month resets. Anthropic’s documentation says that once a tier cap is reached, usage pauses until 00:00 UTC on the first of the next month. Google’s goes further: when a billing account hits its tier cap, service pauses for all projects linked to it. A thief who drains a Google Tier 1 account on the 4th has not just cost you $250. They have switched off every Gemini-powered tool on that account for the rest of the month, including ones the key never touched.
One big cap for the whole business caps the loss, then takes everything down at once.
How do I set an AI API spend limit per tool?
Three steps, and none of them costs anything.
One key per tool, each in its own container. On OpenAI that is a project; on Google, a project in AI Studio. On Anthropic it is a workspace you created, because the docs state you can’t set limits on the Default workspace, so a key living there answers only to the organization-wide limit. If one key leaks, you revoke one key and nothing else blinks.
Give each container a hard limit at two to three times its normal month. On OpenAI, open the project’s settings, then Limits, then Spend, and turn on “Enforce a hard limit”; the guide is explicit that spend alerts alone do not stop traffic. On Anthropic, set the workspace limit and a lower organization limit on the Billing page. On Google, set the project cap in AI Studio, remembering it is experimental and runs minutes behind. Our Claude Haiku 5.5 pricing breakdown shows how small a normal month is for office work: the right cap is usually tens of dollars, not hundreds.
Know what the off switch looks like before it flips. If a tool goes silent mid-month, check the usage page first. If the spike is not yours, the order matters: revoke the leaked key, then raise or reset the limit, then issue a fresh key. Reset the limit first and you have reopened the tap for whoever holds the old key. Our AI cybersecurity playbook covers the wider routine.
The good news inside this story
Every protection above already exists, is free, and takes a few minutes per provider. The seller’s pitch works best on keys left wide open: one shared key, one big ceiling, nobody watching the usage page. Split the keys and cap them low, and a stolen key becomes a nuisance instead of a bill, while your other tools keep running.
AI tools are worth connecting to your business. The key is just a credit card number with a different name, and it deserves the same habits.
Frequently Asked Questions
What happens if someone steals my OpenAI or Claude API key?
They can send AI requests that are billed to your account until the key is revoked or a spend limit stops them. Bitsight’s forum research, reported by Help Net Security on October 16, 2026, found stolen OpenAI, Anthropic and Google keys being used to run an automated hacking tool, with the costs landing on the key owners.
Is there a default spending limit on AI API accounts?
Yes, but it is high for a small business. As of October 17, 2026, the providers’ own pages list $500 a month on Anthropic’s Start tier, $250 a month on Google’s Gemini API Tier 1, and $500 a month on OpenAI’s Build tier, rising to $5,000 a month once an account has bought $100 in credit. You can set lower limits yourself on all three.
Will a spend cap stop charges instantly?
No. OpenAI says enforcement is not instantaneous and recorded spend can slightly exceed the limit, and Google says Gemini API billing data can lag up to around 10 minutes, so overages beyond a project cap are possible. Treat a cap as a strong fence and still revoke a leaked key as soon as you notice unusual usage.
Why would my own AI tools stop working when I hit a spend limit?
Because the limit blocks every request on that account or project, not just the thief’s. Anthropic pauses usage until the first of the next month once a tier cap is reached, and Google pauses every project on a billing account when that account hits its tier cap. Giving each tool its own project or workspace with its own limit keeps one stolen key from switching off everything else.
Do you know which tools in your business are running on an AI key with your card behind it, and who set them up? We would like to hear how many people find one they forgot about.
