How to protect AI accounts and API keys
Keys and login sessions have become criminal targets. Buy only through official channels, and don't install unknown clients just for a discount.
The report shows that stolen API keys and sessions are themselves stolen goods, resold to fake resale networks or used in attacks.
Takeaways
1. Get services only through official websites and official app stores
'Extra-cheap Claude / GPT access' is a recurring lure in the report.
2. Don't install counterfeit AI coding tools or browser extensions
The report says programs disguised as popular assistants continuously collect new login states on the device.
3. Manage keys like passwords: least privilege, rotatable, never committed to public repos
Production keys in evaluation environments and wrapper services especially need isolation.
4. Enable two-factor authentication offered by the provider, and regularly check login sessions
If you spot unusual usage, revoke the key immediately and follow the official account recovery process.
5. Make it clear within the team who can create keys and where they are used
Reduce the chance of 'someone pasting a production key into a chat'.
{esc(t(CURRENT_LANG, "not_confused_with"))}
- Traffic that looks like the official model ≠ your key is still in your hands.
- Account reset once ≠ the collection program on the device is gone.
- A customer environment being breached ≠ the model lab's own systems were compromised.