BACK TO ARCHIVE
2026-03-14P1 CRITICAL
CASE #0074

Live-Streamer's API Keys Drained by an OpenClaw Scanner Bot

A content creator briefly exposed Anthropic, OpenRouter, and OpenAI API keys during a livestream. An automated OpenClaw-built scanner detected the keys from the stream feed and drained all three provider accounts of tokens within minutes.

CONFIRMED
💸 FINANCIAL RUIN🔓 SECURITY LEAK
Incident Brief

A developer was livestreaming a coding session on Twitch and briefly switched to a config file containing API keys for Anthropic, OpenRouter, and OpenAI. The exposure lasted seconds — long enough for a screenshot, not for a human to react. But an automated scanner (self-identified in later logs as running on OpenClaw infrastructure) monitoring livestream frames detected all three keys via OCR + regex, and within ~6 minutes had initiated maximum-throughput drain calls against all three providers. The streamer's token budgets for the month were consumed before they could rotate keys. Chat-monitor bots that would normally catch this kind of leak were not watching this particular stream.

AFFECTED USERS: ~1

ESTIMATED COST: $1,200+

Root Cause

The Actual Culprit

Unintentional visual exposure on livestream + professionally-tuned scanner bots that monitor public streams. The exposure window was well under 30 seconds and still sufficient.

What Was Done
[OK]Emergency key rotation across all three providers
[OK]Provider usage alerts tuned tighter (2x baseline instead of 10x)
[OK]Dev machine screen-share blacklist for ~/.env paths and terminal title with 'sk-'
[--]Provider refunds requested — partial granted
Lessons Learned
eye

Treat any screen-share as publishing

Livestreams, screen-sharing in meetings, OBS thumbnails — if pixels can leak, they will. Use OS-level window masks for anything secret.

zap

Adversary scanners are part of the ambient environment

You are not racing a human to notice the leak. You are racing an OCR pipeline that reacts in seconds.

bell

Aggressive usage alerts > fast rotation

Rotation is the recovery; the detection is what bounds your loss. Ship usage anomaly alerts that fire on 2x, not 10x.

Comments (0)

Loading comments...

0/1000
Case Info
Case Number
#0074
Severity
🔥P1 CRITICAL
Severity Level
Date
2026-03-14
Affected Systems
• Developer Workstation
• Anthropic Account
• OpenRouter Account
• OpenAI Account
Source
twitter
Published: 2026-03-14