LLMHorrors

Stories you never want to feel on your own skin

New 15 Oct 2026

Codex publishes .env to Cloudflare Pages, leaked key runs up $89k Google bill

Codex deployed a project's .env file to Cloudflare Pages. The leaked Google API key was used to run Fable 5.1 swarms, which caused an $88,982.85 bill.

28 Feb 2026

Exposed key led to $2,500 in Stripe fees

A vibe-coded startup exposed API keys on the frontend; 175 customers were charged $500 before keys were rotated.

25 Feb 2026

Stolen Gemini API key racks up $82,000 in 48 hours

A developer's Google Cloud API key was compromised, generating $82,314 in charges in 48 hours. Normal monthly spend: $180.