Stolen AI keys ran up bills. A token budget is also a security measure

Hackers breached an older OpenCode system and reached API keys stored in its console, affecting 1.4 percent of its users. They used the keys to generate large volumes of AI output, with unauthorised charges from hundreds to more than a thousand dollars per account at OpenAI, Anthropic and Google; users were told to revoke and replace their keys (TechCrunch).

The same money is a budgeting topic for every company. netzwoche explains that AI costs keep rising although the price per token falls, because context is resent with every request and agents' token use can vary by up to a factor of 1,000. Its example: a support assistant with 100,000 requests a month costs about 1,600 dollars, one with a million about 16,000.

Both stories describe one control problem. A key without a spending limit is an open invoice for whoever finds it, and an agent without a budget is the same invoice written by your own software. Give each project its own key, set hard monthly limits, get alerts on unusual use and rotate keys on a schedule.

Somebody has to own those keys and budgets. It is a new administrative role, and people with a background in accounting or office management can grow into it with the right training.

Practical step: list every AI key in your organisation, set a spending limit on each and name one person responsible for rotating them.