Direct answer
Treat every AI provider key as a payment method. Give each app and environment its own key, set a spending limit on it, keep it on the server and out of reach of coding agents, and know how to rotate it in minutes. A leaked key is not a data-exposure problem first; it is an open line of credit that attackers start using as soon as they find it.
Why attackers go after AI keys first
A database password needs follow-up work before it pays off. An AI key pays off immediately: whoever holds it can run models on your account until the key is revoked or a limit stops them.
Two incidents in October 2026 showed the pattern. The AI coding tool OpenCode disclosed that provider keys saved in its console, including OpenAI, Anthropic and Google keys, may have been exposed in what it called a large-scale distillation attack, and users reported unauthorized charges on their AI accounts. Days later, the developer platform Railway said an attacker may have decrypted customer environment variables, and described the incident as part of a series of attacks on platform companies aimed at compromising AI inference providers.
Neither incident started with the customer’s own code. The keys sat in a third-party tool and a hosting platform, which is exactly where most teams keep them.
The mistake is treating the key as configuration
Most AI-built apps handle provider keys the way they handle a feature flag: one value, copied into every environment, pasted into the hosting dashboard, the CI settings, a local .env file and, often, a coding agent’s context. Nobody owns it, nothing limits it, and nobody knows which system is spending it.
When we reviewed production issues across about 25 client and internal projects in October, secrets and environment configuration was one of the most common patterns: keys committed to repositories, fallback secrets in code, provider keys shipped to the browser, and placeholder values that only failed in production. AI keys are the most expensive version of that problem.
Five controls that change the outcome
- One key per app and environment. Production, staging, local development, each internal tool and each coding agent get their own key. When one leaks, you revoke one key and can see exactly which system it came from.
- A spending limit on every key. Use the provider’s project or key-level budgets and alerts. A cap turns an open-ended bill into a known, bounded loss.
- Server-side only. A key in browser code is public. Call the provider from your backend or an edge function, and give the client a short-lived token for your own API instead.
- Out of reach of agents. Coding agents that read
.envfiles or credential stores can leak them into logs, prompts or third-party services. Give agents a separate, low-limit key, or none. - Rotation you have practised. Know where each key is used and how to replace it without downtime: create the new key, deploy it, confirm traffic, then revoke the old one.
Detection matters as much as prevention
Most teams learn a key leaked from the invoice. Watch usage per key instead: unfamiliar models, calls at hours your app is quiet, traffic from new regions, or a sudden rise in tokens per request. Per-key usage only tells you something if each system has its own key, which is another reason to split them.
A practical check for this week
- List every AI provider key and every place it is stored, including hosting platforms, CI, local files and AI tools.
- Confirm each one has an owner, a spending limit and a single purpose.
- Move any key found in client code to the server and rotate it.
- Rotate keys stored in any platform that has disclosed an incident.
- Write down how to rotate each key, and time how long it takes.
If a stolen key would cost you more than a day’s revenue before anyone noticed, the controls are not in place yet.
Related Zenveus services: AI Prototype Hardening and the Security & Data Isolation Audit. For the incident itself, see Railway breach: rotate every secret, starting with AI keys, and for every current incident affecting AI-built apps, the Zenveus security alerts.