API Key Exposure

API key exposure happens when the secret credentials that grant access to an AI service, such as those for a model provider or a cloud platform, leak into places they should never be, like public code repositories, shared chat logs, or client-side application code. Anyone who finds a leaked key can often run up usage charges, pull sensitive data, or act under the organization's identity without authorization. For enterprise governance teams, this is a frequent and avoidable source of AI-related incidents, making key storage, rotation, and access monitoring a core part of AI vendor and security controls.

1 item

Corporate PolicyGlobal2026-10-20

OpenCode Breach Exposes Third-Party AI Credential Storage as a Systemic Risk

OpenCode, an open-source AI coding platform, disclosed a security breach in which stored API keys for Anthropic, OpenAI, and Google were exposed during a 48-hour attack. The incident affected 1.4% of users who had linked external AI providers. Some users reported unauthorized charges exceeding $1,700 and had their Google projects suspended for abusive activity.

API key exposure distillation attack AI supply chain risk Anthropic OpenAI Google credential management third-party AI vendors