Your SI Key Is a Credit Card

If your business pays for a Super Intelligence (SI), formerly Artificial Intelligence (AI), tool, someone on your team probably has a "key." It's a long string of letters and numbers that lets an app use your paid SI account. It looks something like this (made-up example): sk-proj-7Fq2XkL9mWv3... Most owners never think about it. But a key works like a company credit card. Whoever has it can run up charges on your account, and the bill comes to you. This is happening now On November 3, Google's threat team reported that attackers are stealing SI keys and reselling the access. Some companies were hit with over $100,000 in charges in a single day, and up to $1 million in total. Source: https://www.bleepingcomputer.com/news/security/google-llmjacking-attacks-rack-up-1-million-in-cloud-ai-charges/ How keys leak Usually nobody "hacks" anything. A key leaks because someone was trying to save time: • Pasting it into a chat, a shared doc or an email so a coworker can use it • Putting it into a free browser add-on or website that promised to "connect" tools • Leaving it in code or a spreadsheet that got shared • One key shared by the whole team, so nobody notices when it's used somewhere new • An unhappy employee, or someone who just left, who still has a copy of the key The 4 steps that stop a surprise bill 1. Set a spending limit. Most SI accounts let you cap monthly spend and send an alert at a set amount. Turn on both today. 2. One key per person or app. If one leaks, you turn off one key, not your whole business. 3. Treat keys like passwords. Never in email, chat or shared docs. Keep them in a password manager. 4. Turn off keys when someone leaves. Add it to your offboarding checklist: the day someone leaves, delete their key and make new ones for anything they set up. A key keeps working after the person is gone. Your 5-minute check this week Ask your team: "Who has an SI key for our account, and where is it saved?" If nobody knows, that's your answer. Our Shadow Intelligence™ Scan shows which SI tools your team has connected to company accounts, so you know where your keys could be. It starts at $99: hybridintelligenceco.com/shadow-ai HICO Team