How to check your OpenAI and Anthropic usage logs for unauthorized access — based on the Gas Town incident (April 2026, 244 HN upvotes). Takes 15 minutes.
API audit checklist for OpenAI and Anthropic accounts — based on the Gas Town incident where a tool was proven to use users' API credits without disclosure.
In April 2026, users of Gas Town — a third-party AI tool that uses your personal API key — discovered it was making calls to unrecognized endpoints on their behalf. The evidence was in their own usage logs: API calls at unusual hours, unexplained billing spikes, endpoints that didn’t match anything they’d built. The GitHub issue received 244 upvotes on Hacker News.
You’ll get:
Anyone who has given a third-party AI tool, automation platform, Chrome extension, or productivity app access to their OpenAI or Anthropic API key. This includes people using no-code tools that integrate with AI APIs.
Also relevant if you’ve noticed billing spikes you couldn’t explain — this checklist will help you trace exactly where the usage came from.
Gas Town is one documented case. Any tool that holds your API key technically has the ability to make calls on your behalf. Most don’t abuse this. But you have no visibility unless you audit. This checklist gives you that visibility in 15 minutes.