Startup founder reports $449 in unexpected AI charges

Startup founder Colin Parsons reported roughly 50 unexpected billing notifications and $449 in unrecognized charges on his OpenAI and Anthropic accounts, and OpenCode disclosed its Console security incident on Oct. 17.

Parsons said the charges came to $281 for OpenAI and $168 for Anthropic, and OpenCode said its AI coding platform was the service tied to both credentials. Anyone holding a working API key can run up charges on the account owner’s billing arrangement by using a paid AI service. OpenCode said intruders may have accessed third-party AI provider keys held by some users through a legacy system breach, and tied the episode to a broad AI model distillation attack without showing publicly how the unauthorized usage happened.

OpenCode urged affected customers to revoke their credentials and said the incident affected roughly 1.4% of Console users who connect external AI providers. The exposed credentials lived in Console rather than in local desktop or command-line applications, according to OpenCode. Other users also reported surprise charges, though those figures remain unverified.

Black October is the name some cybersecurity professionals are using for the current stretch of security emergencies, meaning several separate security incidents instead of a single coordinated hacking campaign. “What concerns me most about this wave of AI-powered cyberattacks is the speed,” said Kurt Knutsson.

On Oct. 21, Microsoft Threat Intelligence said the China-state-aligned hacking group Storm-0940 had used ARTEX, an AI-powered penetration testing framework, across hundreds of organizations spanning multiple industries. The framework automates security testing tasks including network investigation and weakness identification. Attackers achieved unauthorized privileged cloud access in multiple intrusions in less than three hours, and several of those intrusions granted the group privileged access to cloud systems.

Microsoft recorded over 151,000 failed login attempts between Oct. 10 and Oct. 14, targeting 327 accounts at eight organizations. Activity peaked on Oct. 11 at roughly 2,900 failed login attempts per minute. Password spraying involves testing passwords against many accounts until one works, and Microsoft said the campaign produced no observed successful logins.

Microsoft also saw unauthorized access and suspicious activity in other settings connected to that group, and connected Storm-0940 to a breach of ConnectWise, which makes software for IT service providers. The intruders attempted to reach customer environments through ConnectWise cloud application access, while additional activity flowed through Microsoft cloud services including alterations that could preserve access. Microsoft cautioned that suspicious access does not automatically mean customer data was taken.

On Oct. 21, developers issued emergency patches for two critical PHP flaws. The vulnerabilities, known collectively as PHP2Shell, are CVE-2026-109618 and CVE-2026-109619, and could allow intruders to execute malicious code on exposed servers without logging in given particular conditions. Successful exploitation could expose sensitive data or give attackers control of compromised systems.

On Oct. 24, security researcher Adel Karimi documented successful PHP2Shell exploitation against honeypots—specially configured test servers. The exploitation opened 35 command shells across three honeypots, and Amazon Threat Intelligence observed suspicious exploitation attempts beginning before the patches became publicly available. CrowdStrike said it detected attack attempts but had not confirmed successful PHP2Shell exploitation in its investigations as of that point. The honeypot tests did not measure how many real websites were compromised.

CISA added both PHP2Shell flaws to its catalog of known exploited vulnerabilities on Oct. 26. On Oct. 23, the FBI issued a public alert urging organizations to patch affected systems immediately, and CISA likewise called for urgent updates. The Netherlands’ National Cyber Security Centre said on Oct. 23 that exploitation appeared more complex than initially believed and lowered its estimate of broad exploitation likelihood.

PHP released fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and advised operators of older unsupported releases to obtain vendor-supported fixes or switch to a supported version. The PHP Foundation said developers noticed early indicators of one core problem during a 2024 security review but failed to build a dependable fix, and later worked with researchers using AI-based security tools from Anthropic and OpenAI to examine PHP code. Researchers from Calif and Wiz contributed further findings, and the foundation said the outside reports clarified the vulnerabilities’ potential impact and accelerated the fix effort.

PHP additionally disclosed CVE-2026-115560 on Oct. 23, a flaw linked to an unusual combination of server settings and application code, and suggested a short-term configuration change while preparing a fix through its standard release process. Some European government bodies briefly took websites offline as a precaution while the PHP2Shell disclosure was ongoing. Roughly 70% of sites using a known server-side programming language run PHP.

People using AI services with API keys should check usage on a regular basis, revoke any possibly exposed credentials, and configure billing alerts or caps if the provider supports them. AI assists defenders in identifying risky weaknesses before attackers exploit them, but security teams still need to investigate and ship fixes quickly.