Introduction
Artificial intelligence is transforming the way businesses operate. From customer support and CRM automation to content generation and AI-powered applications, companies increasingly depend on third-party AI platforms.
But what happens when an AI account is compromised and usage-based charges spiral out of control?
A recent incident reported by Damy Mocellin, Co-Founder of OhMyCreatives, highlights a serious financial risk associated with AI platforms.
According to his public LinkedIn post, his company's ElevenLabs account experienced unauthorized access between October 25 and 29, 2026, resulting in $15,135 in disputed charges within four days.
This raises an important question: Are businesses protecting their AI expenses as carefully as their customer data?
What Happened in the Reported ElevenLabs Incident?
According to Damy Mocellin, the company experienced several suspicious activities:
Approximately 30 suspicious logins from unfamiliar devices across different countries.
Unauthorized workspace members added.
Multiple API keys created without approval.
Automatic credit top-ups enabled.
Approximately 77 million AI credits consumed.
$15,135 charged without the company's authorization.
The founder also reported $11,550 in unpaid invoices and approximately $14,108 in metered usage under dispute. These amounts may overlap and should not be added together without reconciliation.
The company reportedly consumed fewer than 70,000 credits daily under normal circumstances, primarily for text-to-speech operations.
The company requested an investigation, cancellation of disputed invoices, and reimbursement of the unauthorized charges.
The initial cause of the account compromise has not been established publicly.
Original source: https://lnkd.in/p/eX75FnPz
Why AI API Security Matters
Unlike traditional software subscriptions with predictable monthly fees, many AI platforms charge according to consumption.
Businesses may pay for API calls, tokens, text-to-speech generation, AI videos, image generation, and other computational resources.
If credentials are exposed or automation is misconfigured, consumption can increase unexpectedly.
For example, an application normally spending $10 daily could accumulate significant expenses if unauthorized requests or uncontrolled retries occur.
This means AI security must address both technical vulnerabilities and financial exposure.
1. Implement Spending Limits and Budget Controls
Every business using AI APIs should understand how its provider controls consumption and billing.
Recommended practices include:
Configure daily and monthly budgets.
Enable spending notifications.
Set enforceable spending limits where supported.
Restrict automatic top-ups.
Require additional approval for high-cost operations.
Remember that billing alerts are not necessarily hard spending limits. Some providers continue processing requests even after an alert threshold is reached.
2. Secure API Keys and Credentials
API keys are sensitive credentials that may provide access to paid services.
To reduce security risks:
Store API keys in secure environment variables or secret managers.
Never expose private credentials in frontend applications.
Avoid committing keys to public or private repositories.
Use different keys for development and production.
Limit permissions wherever possible.
Revoke unused or suspicious keys.
Rotate compromised credentials immediately.
Businesses should also review their AI workspace members and restrict administrative access.
3. Monitor AI Usage and Detect Suspicious Activity
AI integrations should include usage monitoring and anomaly detection.
Warning signs can include:
Sudden increases in API requests.
Unusual consumption of AI credits.
Unexpected model or service usage.
Suspicious account logins.
New API keys created without approval.
Changes to billing configurations.
Monitoring systems can send alerts through email, Slack, Microsoft Teams, or other communication channels.
Where appropriate, automated safeguards can pause risky operations until an administrator reviews the activity.
4. Enable Multi-Factor Authentication
Multi-factor authentication adds another layer of protection against unauthorized account access.
Organizations should enable MFA wherever available, review privileged accounts, and avoid sharing administrative credentials.
Sensitive actions such as adding workspace administrators or changing billing settings should receive additional scrutiny.
5. Build Reliable AI Automation Workflows
AI automation can generate unexpected expenses even without an external attack.
For example, an n8n workflow or custom backend application with an incorrectly configured retry loop may repeatedly call a paid AI endpoint.
Production workflows should include:
Rate limiting.
Retry limits.
Duplicate-request protection.
Error handling.
Request timeouts.
Usage logging.
Budget-aware execution.
Human approval for sensitive or expensive operations.
These safeguards make automation more reliable and predictable.
How Developers Can Protect AI-Powered Applications
A production-ready AI architecture should provide control over requests before they reach the external AI provider.
A recommended request flow is:
Application → Backend API → Authentication → Authorization → Rate Limiting → Budget Validation → AI Provider → Usage Monitoring
A controlled backend can validate requests, enforce quotas, log activity, and restrict access.
For applications integrating multiple AI providers, a centralized AI gateway can simplify credential management, usage tracking, and cost monitoring.
However, application-level restrictions must complement provider-level security because they cannot prevent an attacker with direct access to the provider account from bypassing the application.
What To Do If Your AI Account Is Compromised
If unauthorized activity is detected:
Revoke suspicious API keys and active sessions.
Reset credentials and strengthen authentication.
Disable automatic top-ups or pause paid services.
Contact the AI provider's support and security teams.
Notify your payment provider about unauthorized transactions.
Preserve account logs and billing records.
Investigate connected applications and exposed credentials.
Monitor account activity after restoring access.
Fast action can help limit further financial damage.
Final Thoughts
The reported ElevenLabs incident is a reminder that AI adoption requires more than functional integrations.
Businesses need secure credentials, controlled access, reliable monitoring, financial safeguards, and effective incident response.
As an AI Automation and Software Developer, I believe the success of an AI solution should not be measured only by what it automates.
It should also be evaluated by how securely, reliably, and cost-effectively it operates.
Whether you're implementing AI agents, building CRM integrations, or automating business processes through n8n, make security and spending controls part of your architecture from the beginning.
AI automation should reduce business costs, not create uncontrolled financial risks.
About the Author
Muhammad Waqas is an AI Automation and Software Developer specializing in custom software development, API integrations, CRM automation, n8n workflows, and AI-powered business applications.
Portfolio: https://waqaskhattak.com
Original incident reference: https://lnkd.in/p/eX75FnPz
Disclaimer: This article discusses allegations publicly reported by a customer. The incident details have not been independently established, and this article does not conclude that ElevenLabs was responsible for the unauthorized access or resulting charges.