Are Your AI API Keys on Your Asset Inventory?

It was a rough week to be an API key. OpenCode disclosed a breach of its Console that exposed provider keys for 1.4% of users, and some woke up to hundreds of dollars in charges. A backdoored LiteLLM release went after the keys sitting in AI gateways. And the Aoki infostealer added Claude, Codex, Cursor and Copilot tokens to its shopping list.

Three incidents, one target. The kicker is that most organizations could not tell you how many AI keys they have or where they live, because those keys never made it onto the asset inventory.

In this piece, I break down why attackers want AI keys, where they actually hide in your environment and a seven-point AI Key Inventory you can start with a spreadsheet this week.