A stolen provider key does not exfiltrate your data. It spends your money, and the invoice is usually the first alarm you get.
The Hacker News reports Railway says AI provider keys that customers stored on the platform were stolen in an October breach, then used for an estimated $740,000 in unauthorized spending. CISA added an IBM Aspera Faspex incorrect authorization flaw to its catalog of vulnerabilities exploited in the wild. The Hacker News also reports Vates VMS warned of a critical authentication bypass in Xen Orchestra: actively exploited, and still without a CVE identifier.
My advice for anyone running software this week: assume a key will leak, and check whether rotating one is a single command or a week of grepping.
That audit is work I do. Provider keys out of application config and into a managed secrets store, hard per-key spend caps with alerting, rotation reduced to one operation, plus a review of the account flows that guard them. A scope that size takes days, not months, and you get cost and timeline within a day.
Tell me how your product stores its provider keys today and I will tell you what I would change first.