How to Stop a Hacked Work Account From Running Up a Bill
If an account can spend money, assume a stranger will try. Give it a ceiling.
What happened
On October 17, OpenCode, an AI coding tool, said attackers had stolen stored AI account keys from about 1.4% of its console users. TechCrunch reported the thieves used them to run up charges on people's AI accounts, mostly in the hundreds of dollars and in some cases over $1,000. Refunds are under way, and users were told to cancel the old keys and make new ones.
You don't need to write code for the lesson to apply. Work life is now full of accounts that can spend money on their own: AI subscriptions billed by usage, cloud storage, ad accounts, software trials that turn into charges. Each holds a login or a key, and a stolen one costs the thief nothing to use.
The fix is dull and effective: a ceiling on what each account can spend, an alert when it gets close, and a habit of telling IT the same day when something looks off.
What to do
- List what can spend. Every work account that's tied to a card or bills by usage: AI tools, cloud services, ads, design and video apps.
- Set a cap and an alert. In each account's billing settings, look for a monthly limit or budget and a usage alert to your email. Where there's no cap, use a card with a low limit.
- Clear out connected apps. In your work email and calendar settings, review which apps have access. Remove anything you don't recognize or no longer use.
- Keep secrets out of chatbots. Never paste passwords, account keys or customer data into an AI tool your employer hasn't approved.
- Report weird logins the same day. An unexpected sign-in alert or charge goes to IT or the account owner now, not after the weekend. Early reports are cheap; late ones aren't.
The prompt
Help me make an inventory of work accounts that can spend money or hold payment details. Here is what I use at work, with no passwords or keys: [list tools, e.g. ChatGPT Team, Google Workspace, Canva, Zoom, Meta ads, AWS]. For each one, tell me: does it typically bill by usage or subscription, where in its settings I'd usually find spending limits or budget alerts, and what to ask IT if I can't find them. Put it in a table with columns: Tool, Who owns it, Cap set (Y/N), Alert set (Y/N), Notes. Never ask me for passwords, API keys or card numbers.
Check each tool's own help pages for current menus; settings move around.
Where it still needs a grown-up
- Your employer's IT and finance rules come first. If you don't own an account, flag it to whoever does rather than changing settings yourself.
- A cap limits the damage. It doesn't remove the stolen key: if you suspect one leaked, cancel it and make a new one.
- If a charge has already gone through, contact the provider and your card issuer quickly; refund windows can be short.
The verdict
Nobody gets promoted for a spending cap. Plenty of people have had to explain the lack of one.