55RISK
LLM API key abuse
A leaked LLM API key is being used for someone else's workload.
Full brief ▾
The LLM provider dashboard shows a 15x token spike from 2am-5am, from IPs outside our ranges, with prompts unrelated to our product (bulk translation and content generation). Suspected key leak.
index=llm_billing | timechart span=1h sum(tokens) by api_key_id | where tokens > 10 * hourly_baselinedetection query
index=llm_billing | timechart span=1h sum(tokens) by api_key_id | where tokens > 10 * hourly_baseline
Signal feed4 events
2026-07-18T02:00:00Zllm-billingapi_key_id=sk-live-a91 · tokens=4200000
ts2026-07-18T02:00:00Z
sourcellm-billing
api_key_idsk-live-a91
tokens4200000
src_ip45.83.x.x
geoNL
2026-07-18T03:00:00Zllm-billingapi_key_id=sk-live-a91 · tokens=5100000
ts2026-07-18T03:00:00Z
sourcellm-billing
api_key_idsk-live-a91
tokens5100000
src_ip45.83.x.x
geoNL
2026-07-10T11:00:00Zgithub-scanapi_key_id= · tokens=
ts2026-07-10T11:00:00Z
sourcegithub-scan
api_key_id
tokens
src_ip
geo
2026-07-18T09:00:00Zfinanceapi_key_id= · tokens=
ts2026-07-18T09:00:00Z
sourcefinance
api_key_id
tokens
src_ip
geo
▸ syncing case…