Who Pays for Stolen Inference?

Eight months ago, a developer posted on Reddit that he was facing bankruptcy after someone stole his API key and spent $82,000 in 48 hours. His company normally spent $180 a month. The stolen key ran up $82,314.44 in charges, almost entirely on Gemini 3 Pro image and text generation.

He said Google support cited its shared responsibility model and told him the charges stood. Days earlier, Truffle Security had shown why such keys leak so easily: Google spent years telling developers that Maps and Firebase keys could sit in public HTML, then let the same keys call Gemini once the API was enabled on a project. Google first classed the report as intended behavior, then reclassified it as a bug.

In 2026, building software has become almost as easy as sending a text message, and an underground market for stolen API keys is thriving. Breaches like this are happening more and more often.

On October 21, Railway discovered that unauthorized third parties had accessed several API keys and registry credentials. The company said the breach affected 100,000 workspaces.

A week earlier, on the night of October 16, developers using OpenCode, an open-source coding agent, watched their spend alerts fire at OpenAI, Anthropic and Google at the same time. The breach affected 1.4% of OpenCode Console users overnight. The company wrote on X: “We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users.”

Users posted charges in the hundreds of dollars per account, with a few above $1,000. Anthropic and Google blocked keys they believed were exposed. OpenAI said it worked with OpenCode to restore access and refund its API customers. OpenCode co-founder Dax Raad said attackers kept trying to get back in for 48 hours.

OpenCode did not explain how it linked the breach to a “large-scale distillation attack,” but all major AI companies have documented the growing threat of distillation attacks. If the link holds, a stolen key is no longer just someone else’s free inference. It is training data for a rival model, billed to you.

Why the bill is the breach

A leaked database password exposes data. A leaked model API key spends money, fast, and the spending looks legitimate. Every request is authenticated. The provider sees a paying customer. Nothing goes down. In most of the 2026 incidents below, the victim learned about the compromise from a spend alert or an invoice, not from a security tool.

Three things made this worse this year:

• Demand went up. Google’s Threat Intelligence Group told the Financial Times that underground prices for stolen Claude, Gemini and Cursor Pro accounts more than doubled in 2026, with some vendors offering access at up to 97% off list.
• Supply got organized. Pillar Security and Sysdig documented Operation Bizarre Bazaar, which logged about 35,000 attack sessions on exposed AI endpoints between December 2025 and January 2026 and resold the access through a marketplace called silver.inc on Telegram and Discord.
• Each call got pricier. Agents loop. A single task can trigger many model calls, tool calls and retrieval steps, each billed. OWASP’s 2026 Top 10 for LLM applications now lists unbounded consumption, including denial-of-wallet attacks, as LLM06.

Google’s chief analyst John Hultquist described the result as a cost asymmetry: attackers buy compute cheaply while defenders pay full price. He also warned that companies early in their AI rollouts may mistake an attacker’s spike for normal growth.

$600,000 worth of credits burned

In September this year, METR disclosed that an attacker stole one of its API keys and used $600,000 worth of credits. The model provider had given METR the credits for free. It was not the only attack on METR this year. “In March 2026, attackers stole an API key for inference on public models and consumed a substantial amount of credits,” the nonprofit said.

The AI evaluation nonprofit said a researcher ran agents on a personal EC2 instance meant to sit behind Google login. A vibe-coded app had a fail-open bug that left it public for several days. METR thinks the attacker found it by combing certificate transparency logs for new sites with LLM and agent keywords. The attacker then simply asked the agent for its provider key, added an SSH key for persistence, and spent for three weeks. METR said it missed the activity because its evaluations already produce heavy token use and constant rate-limit errors, and because there was no way to put a spending limit on that kind of key at the time.

Skynet: the autonomous offensive agent

On October 21, Symantec’s Threat Hunter Team published its analysis of an autonomous offensive agent called “Skynet.” It hunts for model endpoints that accept OpenAI-style calls without authentication, then uses the hijacked model to plan scanning, exploitation and crypto-mining against other targets. Its configuration allowed up to 100,000 unattended steps across about 74 tools. Symantec’s honeypot never ran the tools, and Symantec has no evidence of completed compromises, but the endpoint owner would have paid for every step of planning.

The threat to LLM security is evolving faster than any one company can keep up with.

Where the stolen tokens go

Our earlier investigation into the relay market documented resold LLM access built on pooled stolen credentials, abused free trials and open-source proxies like one-api and new-api, with buyers in China looking for cheap tokens and distillation data. This year’s disclosures fill in who those buyers are.

Anthropic’s threat report, published September 10, says seven China-based labs ran campaigns to extract Claude’s capabilities. “Alibaba’s illicit distillation campaign peaked at nearly 3 million exchanges per day launched from more than 3,500 fraudulent accounts,” the report noted. The labs routed their traffic through proxy layers Anthropic calls “transfer stations,” the same relay architecture we documented.

The resale side looks like the relay market, with new sources of supply. Okta traced a vendor branded “Poison Claude” selling Opus and Sonnet at 5 to 15% of list price, stocked partly by farming free welcome credits such as AWS Bedrock’s $100. Because it proxies every call, Okta’s researchers said, it can read and alter prompts and responses in transit.

Who pays

Let’s look at some of the cases discussed in this blog.

Concerns about LLM security are tied not only to regional sovereignty and proprietary models but, most importantly, to a market with a greater incentive to attack than any before it.

AI cost control is now fundamental

AI cost control is a system for monitoring, managing and optimizing the resources your company’s AI systems consume. In many cases, it also means placing a cap or limit on those resources.

AI has made it possible to automate more tasks and modernize workflows, but it comes with unpredictable operating expenses, because each interaction with an AI tool adds to the total cost. A single prompt can trigger multiple steps, from processing tokens to generating a response to agents calling other tools. Each step can increase what you pay.

A major challenge is that many organizations pay based on consumption, and token consumption varies with the task. Two users could send the same number of requests, and one could still cost your company tens of thousands of dollars more than the other.

Take a simple example: a customer asks your AI chatbot when an order will be delivered. When the LLM reads the question, you incur a charge. The agent searches your company’s database for the answer, so you incur vector store costs. The agent then checks with UPS to verify the ship date, incurring an external API cost. Finally, the agent processes all the data it has received to produce the answer. You pay at each step.

Depending on which AI models you use and how, your cost control efforts may involve limits on:

• Input and output tokens
• API requests
• AI agents
• Model inference
• Vector databases
• Retrieval-augmented generation (RAG)
• Image, video and audio generation
• Data storage
• GPU infrastructure
• Network traffic

In most cases, the goal is broader than limiting spending. You want every dollar you spend to deliver the most value from the AI work you are doing.

Malicious attacks are among the hardest costs to control. You may not know you have been attacked until the bill arrives, and the attacker’s use may not affect your own, so nothing warns you that something has gone wrong.

That is why spend is the earliest signal you get. In METR’s case it was the only signal, and it was missed for three weeks. Tracking cost per key, per end user and per model in real time, with alerts set below the point of pain, turns the invoice into an intrusion detector. Treat AI cost management not just as budgeting but as a core part of your security protocols.

Vectoral is a simple, effective AI cost management tool that shows you exactly who is burning your inference budget before your bill arrives. Reach out today to learn more.