Opening case…
Loading your run…
A leaked LLM API key is being used for someone else's workload.
The LLM provider dashboard shows a 15x token spike from 2am-5am, from IPs outside our ranges, with prompts unrelated to our product (bulk translation and content generation). Suspected key leak.
index=llm_billing | timechart span=1h sum(tokens) by api_key_id | where tokens > 10 * hourly_baselinedetection queryindex=llm_billing | timechart span=1h sum(tokens) by api_key_id | where tokens > 10 * hourly_baseline