Portable affichant du code dans une pièce éclairée en bleu, illustrant le vol de clés API d'IA

Stolen AI API keys: OpenCode, Railway, LiteLLM and surprise bills

In one week, four services used by developers announced a leak or a possible leak of secrets: Zeabur, OpenCode, LiteLLM and Railway. What they have in common: AI API keys that unlock paid models from OpenAI, Anthropic or Google. For an attacker, a stolen key means free AI, paid for by someone else. OpenCode users saw charges of a few hundred US dollars, up to 1,700 US dollars.

You don’t use any of these services? Your freelancer, your web agency or your website’s chat plugin might. Railway says the attack is part of a series targeting platforms to get at AI providers. Here is what happened, where your keys hide and what to do now.

AI API keys: a week of incidents

Affected service	When (Eastern Time)	What leaked or may have leaked	What the service asks
Zeabur (app hosting)	October 14 and 15	About 3.2 million environment variables (where keys are stored)	Rotate every key; the service shuts down in December
OpenCode Console (AI coding tool)	Intrusion overnight on October 16; customer notice on the morning of the 17th	OpenAI, Anthropic and Google keys saved by 1.4% of Console users	Revoke and replace keys with each provider. Charges of a few hundred US dollars, up to 1,700 US dollars, were reported; refunds under way
LiteLLM 1.107.0 (gateway to several AI models)	October 21: PyPI 7:39 to 9:23 a.m., Docker 7:46 to 10:20 a.m.	Booby-trapped release published after GitHub tokens were stolen	Go back to version 1.106.2 and rotate keys if 1.107.0 was installed
Railway (hosting platform)	Detected on the morning of October 21; public notice at 6:10 p.m., storage credential rotation at 6:37 p.m.	Encrypted environment variables, in some cases decrypted	All users: rotate API keys, registry credentials and other secrets

Times are converted to Eastern Time (UTC-4). The open-source OpenCode app and its command-line tool were not affected: only the older online Console was. At LiteLLM, the cause was a classic slip: GitHub tokens visible in the logs of an exposed internal deployment.

Where your small business’s AI API keys hide

💬

Your website chatbot

The WordPress plugin that answers visitors often keeps an OpenAI key in its settings.

🔗

Zapier, Make or Power Automate

Every scenario that “asks the AI” holds a key or a connection.

🧑‍💻

The freelancer’s app

Hosted on Railway, Zeabur or elsewhere: the keys live in its environment variables.

💻

The developer’s laptop

A .env file forgotten in a project folder or a backup copy.

📨

A Teams message or an email

“Here’s the key to test with”: it’s still there, months later.

📊

The access spreadsheet

Handy, but readable by anyone who can open it.

The same risk already existed with AI servers left open, as we saw with PoeLLM and exposed Ollama and LiteLLM servers, and with booby-trapped developer tools like the compromised OVHcloud CLI extension.

Good key, bad key

Three API keys, three risk levels (fictional examples)

🔑 “test-2024” key

❌ Created by a former freelancer
❌ Access to every model
❌ No spending limit
❌ Used in three tools

Revoke today

🔑 “website-chat” key

✅ Single use: the website
✅ Known owner
❌ Not changed in 18 months
❌ No usage alert

Replace this week

🔑 “invoices-2026” key

✅ One project, one use
✅ Prepaid credits, no auto-recharge
✅ Usage alert on
✅ Rotated every 90 days

Good model to copy

Simple rule: one key per tool, with an owner, a limit and a replacement date.

Limiting the bill if a key leaks

Your AI bill: where to put the guardrails

Early alert

An email when usage goes past your normal month, so you can react the same day.

Limit or prepaid credits

Where the console offers it, a spending limit or prepaid credits with no auto-recharge.

What a thief aims for

A key with no limit, used at night and on weekends: that’s where surprise bills grow.

Careful: every provider works differently. In Google Cloud, for example, a budget sends alerts but doesn’t stop billing. Check the settings in each console.

What to do this week

Your plan, in order

Take inventory

List every tool that uses a paid AI: website, automations, custom apps, plugins.

Ask your suppliers

Does your freelancer or agency use Railway, Zeabur, LiteLLM or OpenCode? If so, which company keys were there?

Rotate exposed keys

Create a new key, put it in the tool, then revoke the old one with the AI provider. In that order, to avoid downtime.

Read recent bills

Look at usage since October 14. A sudden spike at night is a warning sign; contact the provider about a refund.

Put guardrails in place

One key per tool, usage alert, limit or prepaid credits, a named owner and a replacement date.

🔑 What if your WordPress site uses AI?

A chat or writing plugin with AI keeps its key in the site’s database. If the site is hacked, so is the key. Keep plugins up to date, limit administrator accounts and give that key its own limit. Our website design team can check where it is stored.

At NeoTech, our cybersecurity services start with this access inventory, and our automated 24/7 monitoring with on-call technician response through cyber monitoring spots unusual sign-ins and behaviour on your accounts and devices. To frame your AI projects properly from the start, see also our AI and automation consulting.

Book your free cyber check

Not sure how many AI keys are scattered across your tools, or who controls them? The free cyber check reviews your access, your suppliers and your guardrails, then hands you a clear plan.

👉 Book your free cyber check

Call us at 438-476-2322 or email info@neotechcloudsolutions.com.

Sources

Photo: Nemuel Sereti, Pexels (Pexels licence).