AI Coding Tools and Leaked API Keys: A 15-Minute Secrets and Billing Cap Routine

On August 26, 2025, attackers exploited a GitHub Actions workflow flaw in the popular Nx JavaScript build system and published malicious versions to npm in a campaign tracked as s1ngularity (BleepingComputer, August 2025; GitGuardian Incident Analysis, August 2025). Instead of running only static file searches, the malware (telemetry.js) invoked developers' locally installed AI command-line assistants, including Claude, Gemini, and Amazon Q CLIs, passing flags that skipped confirmation prompts so the AI tools hunted down .env files, SSH keys, and cloud tokens on macOS and Linux laptops and uploaded them to public GitHub repositories. Before containment, 2,180 GitHub accounts and roughly 7,200 repositories were exposed. Weeks earlier, in July 2025, an attacker injected a wiper prompt into Amazon Q's VS Code extension repository (SC World, July 2025). Even without malware, pushing one .env file with an OpenAI, Anthropic, or AWS key draws automated bot scraping in seconds and can trigger a $10,000+ overnight bill before morning.

Annual scan data shows how rapidly AI-assisted coding has accelerated credential sprawl. In GitGuardian's State of Secrets Sprawl 2025 report (analyzing 2024 public GitHub commits, GitGuardian 2025 Report), scanners recorded 23.8 million new hardcoded secrets on public GitHub in 2024, a 25% year-over-year rise in that report, while public repositories with GitHub Copilot active showed roughly a 40% higher secret-leakage incidence rate than the public repo baseline (6.4% versus 4.6% public repository leak rate). One year later, GitGuardian's State of Secrets Sprawl 2026 report (analyzing 2025 commits, published March 2026, The Hacker News / GitGuardian 2026) counted 29 million (~28.65 million) new exposed secrets on public GitHub in 2025, a 34% year-over-year jump in that report, with leaked AI-service keys surging 81% year over year. Worse, 64% of valid secrets first leaked in 2022 still worked in the 2026 report's checks (compared to 70% in the 2025 report).

Small dev teams and technical learners can close these paths without buying enterprise vaults. Paired with our pre-launch security gate for vibe-coded software and our small-team AI agent ID card, this guide maps the four leak channels, walks through overnight token-draining math, contrasts alert-only cloud budgets against real hard stops, and provides the ed.cafe 15-Minute Small-Team Secrets, Billing-Hard-Cap & Pre-Commit Routine. Note that this guide offers general operational engineering hygiene, not legal or financial audit advice.

How API keys escape when teams build with Cursor, Claude Code, Copilot, or Replit

Developers rarely publish OPENAI_API_KEY="sk-proj-..." on purpose. Secrets leak through four predictable workflow shortcuts where fast AI code generation meets frontend bundlers, Git commit history, and local IDE indexing.

Deleting .env in a second commit (git rm .env && git commit -m "remove key") without revoking the key inside your provider console is like taping a photocopy of your corporate credit card and CVV to a subway station wall, walking back ten minutes later to pull the paper down, and assuming the card number is safe again. Where that subway-wall analogy breaks down is permanent Git storage and bot speed. First, git rm removes the file only from the head snapshot while leaving the plaintext secret inside .git/objects history (git log -p). Second, automated credential-harvesting bots watch GitHub's public Events API stream continuously and test newly pushed sk-proj-, sk-ant-, and AKIA keys within 3 to 60 seconds of git push.

Watch Pathway 2 (NEXT_PUBLIC_ and VITE_) closely. Frontend frameworks (Next.js, Vite, Create React App, Expo, Astro) physically inline any variable carrying a public prefix (NEXT_PUBLIC_, VITE_, REACT_APP_, EXPO_PUBLIC_) straight into the downloadable .js bundle sent to every website visitor. Even if your GitHub repo is private and .env sits in .gitignore, naming a variable VITE_ANTHROPIC_API_KEY ships your live billing key to every browser on earth.

Pathway 3 also explains why GitGuardian's 2025 report found 58% of all 23.8 million leaked credentials were "generic secrets" (database URIs, webhook tokens, and passwords without standard prefixes) and why 35% of private repositories in that 2025 report held plaintext secrets. When an AI IDE indexes .env or docker-compose.yml, it routinely copies live database URIs into generated unit tests (db.test.ts) that pass casual human glances.

The overnight $10,800 token-draining math ("LLMjacking")

Stolen AI and cloud keys rack up five-figure charges overnight because attackers documented by Sysdig Threat Research run automated LLMjacking proxy pools. Within seconds of scraping a valid OpenAI, Anthropic, Gemini, or AWS Bedrock key, scripts test its rate-limit tier and resell completions to thousands of simultaneous proxy users.

Check the arithmetic on one leaked production key with every assumption stated:

• Assumed key quota: A startup production OpenAI or Anthropic key past starter tiers ($100 to $1,000 prior spend), sustaining 1,200,000 output tokens per minute on flagship or reasoning models, with credit-card auto-recharge enabled and zero monthly hard cap.
• Assumed output rate: $15.00 per 1 million output tokens (excluding input tokens to keep the estimate conservative; AWS AKIA keys with Bedrock or EC2 GPU permissions can burn $30 to $90+ per hour per region in parallel).
• Assumed window: Pushed at 11:30 p.m. Friday; spotted at 9:30 a.m. Saturday (10 hours = 600 minutes).

Compare uncapped auto-recharge against a hard-capped dev project:

1. Per-minute drain: 1.2M tokens/min x $15.00 / 1M = $18.00 per minute.
2. Per-hour drain: $18.00 x 60 minutes = $1,080.00 per hour.
3. 10-hour overnight bill (uncapped): $1,080.00 x 10 hours = $10,800.00 charged before Saturday morning.
4. Same 10-hour leak on a $50 hard-capped dev project (auto-recharge OFF): $50.00 max loss, followed by automatic 429 insufficient_quota shutoff at 11:32 p.m. (99.5% loss reduction in this 10-hour scenario).

Vendor billing teams never guarantee courtesy waivers under commercial API terms. Hard spend caps are mandatory financial controls.

Alert-only budgets vs real hard stops across OpenAI, Anthropic, Google Cloud, and AWS

Never assume a cloud "Budget Alert" stops your card from being billed. Several cloud consoles send polite 3:00 a.m. warning emails while letting attackers spend $15,000 by sunrise.

Double-check AWS and GCP today: without an explicit AWS Budget Action applying an automatic Deny policy (or strict GCP per-day API Quotas), budget emails merely narrate the theft while it happens.

The ed.cafe 15-Minute Small-Team Secrets, Billing-Hard-Cap & Pre-Commit Routine

Gather your builders for 15 minutes and apply the ed.cafe 15-Minute Small-Team Secrets, Billing-Hard-Cap & Pre-Commit Routine across every active repo and cloud console. Every tool below (git, gitleaks, ignore files, and GitHub Push Protection on public repos) costs $0.

================================================================================
MINUTES 00-04: LOCK BILLING HARD CAPS & SPLIT DEV / PROD KEYS
================================================================================
[ ] 1. OpenAI & Anthropic: Turn OFF "Auto-recharge / Auto-reload" on dev tiers.
       Split into `Dev_Local` ($25-$50/mo hard cap) and `Prod_Live` (1.5x normal
       monthly spend). Zero `Prod_Live` keys stored on developer laptops.
[ ] 2. AWS & GCP: Do NOT trust email-only budget alerts. Lower daily per-model
       API Quotas on GCP; attach an AWS Budget Action applying an automatic IAM
       `Deny` policy at 100% threshold; confirm 0 root keys exist.
[ ] 3. GitHub Push Protection: Enable `Secret scanning` + `Push protection` on
       every repo AND user account (`github.com/settings/security_analysis`).

================================================================================
MINUTES 04-08: ADD UNIFIED GIT + AI CONTEXT IGNORE FILES
================================================================================
Place these exact patterns in BOTH `.gitignore` AND `.cursorignore` /
`.claudeignore` so neither Git nor your AI IDE reads or echoes local secrets:

.env
.env.*
!.env.example
*.pem
*.key
*.p12
*credentials*.json
*service-account*.json
.aws/
.ssh/
.npmrc
mcp_config.local.json

Commit ONLY `.env.example` with dummy placeholders (NEVER `NEXT_PUBLIC_` or `VITE_`
on secret backend keys):
  OPENAI_API_KEY="<LOAD_FROM_1PASSWORD_OR_HOST_SECRET_MANAGER>"

================================================================================
MINUTES 08-12: INSTALL GITLEAKS LOCAL PRE-COMMIT BLOCKER
================================================================================
1. Install free CLI tools:
     brew install gitleaks pre-commit

2. Save `.pre-commit-config.yaml` in repo root:
     repos:
       - repo: https://github.com/gitleaks/gitleaks
         rev: v8.24.0
         hooks:
           - id: gitleaks

3. Enable hook and test:
     pre-commit install
     gitleaks git --pre-commit --redact --verbose
   (Any `git commit` containing a key aborts locally with Exit Code 1.)

================================================================================
MINUTES 12-15: CLI SAFETY FLAGS & 4-STEP EMERGENCY LEAK RUNBOOK
================================================================================
[ ] Never pass `--dangerously-skip-permissions` to AI CLIs in folders with `.env`
    or `~/.aws` (`s1ngularity` defense). Vet MCP plugins before install.

IF A KEY EVER HITS GIT COMMITS, A BROWSER BUNDLE, OR CHAT LOGS:
  Step 1 (Minute 1 - REVOKE FIRST): Delete/revoke the key in OpenAI / Anthropic /
         AWS console IMMEDIATELY. Never rewrite Git first while the key is live!
  Step 2 (Minute 3 - AUDIT LOGS): Check API usage logs, CloudTrail, and billing.
  Step 3 (Minute 7 - REPLACE SAFELY): Mint a scoped replacement key directly into
         Vercel/Render encrypted env storage or 1Password.
  Step 4 (Minute 12 - SCRUB & CALENDAR): Clean repo history (`git filter-repo`)
         and add the new key to your 90-day quarterly rotation calendar.

Why deleting the file in Git fails and how to keep 90-day secret hygiene

Memorize Step 1 of the Emergency Runbook in the ed.cafe 15-Minute Small-Team Secrets, Billing-Hard-Cap & Pre-Commit Routine: Revoke in the console first, scrub Git history second. Spending twenty minutes Googling git filter-repo or deleting your GitHub repository leaves the scraped key active in the attacker's proxy pool; clicking Revoke in OpenAI, Anthropic, or AWS kills external abuse in twenty seconds. Pair that drill with our first-hour AI incident response plan and our 12-point MCP server and plugin install check.

Close the two remaining office leaks highlighted in GitGuardian's 2026 report:

1. Stop pasting keys in Slack, Teams, and Jira (28% of enterprise secret leaks in GitGuardian's 2026 report): Send dev credentials exclusively via single-view expiring vault links (1Password or Bitwarden Send) or managed env sync (Doppler, Infisical, Vercel env pull).
2. Run a 15-minute quarterly zombie-key sweep (64% of 2022 valid secrets still active in 2026): On the first Monday of each quarter (alongside checklists in the ed.cafe Staff Room), delete any API key with 0 calls in 30 days and rotate static keys older than 90 days using a five-minute dual-key overlap.

Where this stops being true

Four technical boundaries require controls beyond local pre-commit hooks and ignore files:

• Low-entropy generic passwords (58% of leaked secrets in GitGuardian's 2025 report): Prefix and entropy scanners catch sk-proj- and AKIA reliably, but human-chosen database passwords like BostonFall2026! inside custom config files can evade regex rules. Never hardcode any credential outside .env or a secret manager.
• Bypassed local hooks (git commit --no-verify): Developers can skip local hooks with --no-verify or forget pre-commit install. Backstop laptop hooks with server-side GitHub Push Protection and a 20-line GitHub Actions gitleaks check on every pull request.
• Malicious npm or PyPI install scripts (s1ngularity): .cursorignore only guides cooperative AI editors; malware running inside npm postinstall reads .env straight from disk. Keep Prod_Live keys strictly inside cloud hosting vaults, never on developer laptops.
• Mobile and desktop client binaries (iOS, Android, Electron): Any API key compiled inside a downloadable app binary can be extracted with strings or mitmproxy. Route mobile and desktop AI calls through your own authenticated backend server holding the key server-side. Again, this guide provides general operational engineering practices, not a formal security audit or legal advice.

Questions people ask

Key terms

• Secrets sprawl: The spread of plaintext API keys, database passwords, OAuth tokens, and certificates across Git history, chat logs, tickets, and frontend bundles.
• LLMjacking: Automated harvesting and proxy reselling of leaked AI and cloud API keys (OpenAI, Anthropic, AWS Bedrock), draining the owner's billing quota.
• Pre-commit hook (gitleaks): A local check triggered automatically on git commit that scans staged diffs for secret patterns and aborts the commit before git push.
• .cursorignore / .claudeignore: Root config files instructing AI coding tools not to read, index, or include sensitive local files like .env inside model prompts.
• Client-bundle inlining (NEXT_PUBLIC_ / VITE_): Build-time replacement that bakes public-prefixed environment variables directly into browser-accessible JavaScript chunks.
• GitHub Push Protection: A server-side GitHub check that scans incoming git push commits and blocks pushes containing recognized live secret formats.

Sources

1. BleepingComputer, "AI-Powered Malware Hit 2,180 GitHub Accounts in s1ngularity Nx Supply-Chain Attack" (August 2025): BleepingComputer Report
2. GitGuardian Security Blog, "s1ngularity Supply Chain Attack: Weaponizing AI CLI Tools to Harvest Secrets" (August 2025): GitGuardian Incident Analysis
3. SC World, "Amazon Q Extension for VS Code Reportedly Injected With Wiper Prompt" (July 2025): SC World Article
4. GitGuardian, "The State of Secrets Sprawl 2025 (23.8M public GitHub secrets in 2024; Copilot repository analysis)" (March 2025): GitGuardian 2025 Report
5. The Hacker News (covering GitGuardian), "The State of Secrets Sprawl 2026: 29M New Secrets on GitHub and 81% Surge in AI Keys" (March 2026): The Hacker News Report
6. Gitleaks Open-Source Project, "Gitleaks: Protect and Discover Secrets Using Git Pre-Commit Hooks": Gitleaks GitHub Repository
7. GitHub Docs, "Push Protection for Repositories, Organizations, and Users": GitHub Security Documentation
8. Sysdig Threat Research Team, "LLMjacking: Stolen Cloud Credentials Used in New AI Attack": Sysdig Threat Research