Hey Guys! Today I got a soft limit usage e-mail from openai but I don’t use anything. I don’t publish my product yet but there is an $37 usage!! what is this?
1 Like
Welcome to the developer forum.
How are your keys stored? Are they in relay server/host server environment variable, handled by a deployment host key management service (Azure, AWS, Google key services, etc?) or are they in your source code?
How many people have access to that code and your keys and have you performed a check of your dev environment for potential compromises, i.e. virus or other compromise methods?
Have you revoked your API keys yet? if not you should do so and turn on 2 factor authentication
2 Likes
Thank you. Yes, they are in server environment. Until today, I didn’t have any problem with that. I revoke my API key and create a new one but until now it is still going up!
Ok, as a first port of call, I would visit this helpful post
https://help.openai.com/en/articles/7242626-how-can-i-report-fraud-or-suspicious-activity
you should see a Chat Bot icon in the bottom right corner 
There you can register your details and issue along with the information in that post.
Check your organization and revoke all members except yourself, change your password, cancel all keys.
We are experiencing the same thing. This started yesterday evening JUL17th and today massive amounts of requests and we blew through 380USD and on average we only use 10USD a day. All keys rolled all accounts reset and this is still happening.
This is with a brand new KEY that only I have… and I have only created 10 total prompts.
Today JUL 18th
Welcome to the developer forum,
Please visit this site How can I report fraud or suspicious activity? | OpenAI Help Center
the post contains the information you need, then use the Chat Icon in the bottom right corner to bring up the chat bot.
This is not fraud or suspicious activity, this is OpenIA’s backend that needs review
Totally could be, but better safe than sorry.
If there are any updates I’ll be sure to post them here.
1 Like
SSO Gmail Account. Only One IP using my Account (Which is me), New API KEY, Validated all data sources. Only One area with new API key on a brand new server and as soon as I generate 1 prompt it the OpenAI Usage reports massive amounts of requests. This is indeed a issue with OpenAI. I have submitted a ticket and still waiting on a response.
If:
- you delete all api keys and the activity stops
- you create a new api key and the activity doesn’t resume
- you set your server environment variable or software to the new API key and get hit:
It sounds more like your server has been hacked with malware on it, or you have an insecure backend being abused.
if it literally is “as soon as I generate one prompt” then you might have something going off the rails and looping requests.
Observe the size if the usage is showing up in by the minute to see if someone is running the same job, similar job, or without relation, by tokens.
1 Like
Sure… Or if you look at this screenshot… GPT 3 normal and GPT4 off the rails…
No code has changed. Server logs normal, verified with Cognito access and Cloudwatch logs.
Normally, I would agree with you but on this one… Something is up…
Additionally, no code changes, no server updates, even tested on a new EC2 and completely different region with nothing configured.
Might be related…
A new implementation from OpenAI could completely stop easy abuse from leaks:
Enabled models and custom names
| Model | Custom? | Name Mapping | Enabled? | Edit Allowed Keys |
|---|---|---|---|---|
| gpt-3.5-turbo | No | Default (chat model) |  |
 |
| gpt-4 | No | Default (chat model) |  |
|
| gpt-mycoChat | Yes | → gpt-3.5-turbo-0301 | |
|
| gpt4-secretphrase | Yes | → gpt-4 | |
|
| davinci | No | Default (completion model) | |
|
Default key allow policy: Deny🔽
Create new custom model name to model mapping
(UI)
Huh.
Have you tried unloading your API key after making the request? Do you even have anywhere in your code which switches to GPT-4? How did you send “test” as an input? Through a unit test? Are you using the official library?
After purging keys, I would submit the same inputs to a local python API example for a while, and see if they get you the same false GPT-4. That would indicate some database corruption on the OpenAI side.
See if you can work around with creating a second account allowed on your phone number. Inviting it to your organization as reader. Setting the default API key billing on that to your organization, and making only a new key there. Submitting that account’s keys to your local simulator, then to API product, separated by the 10 minute intervals to see where the fault lies or where you’ve been compromised.
I manually, select between the two. I tested after restarting the server. This only started happening yesterday mid-day. I have been using the code I wrote for the last 2+ months with no issues.
Around 10AM yesterday is when things started going crazy.
Verified logs, verified sen/rev packets all look normal but OpenAI is recording the API usage completely different than what is happening.
And what happens if you globally set the maximum tokens to 21? Not doubting you. Just curious and would like to see what’s going on.