{"success":true,"data":{"id":"agentic-ai-runaway-spend-phish","label":"Fake AI API runaway-spend / overage alert (OpenAI/Anthropic/Claude API) to harvest API keys or cloud credentials from non-official sender","description":"Fake AI API runaway-spend or overage alert targeting developers with unauthorized charges to harvest API keys or cloud credentials. As agentic AI workflows become mainstream, runaway agent costs ($500-$5,000+ overages from misconfigured loops) are a real and well-documented pain point. Attackers exploit this fear by sending fake \"Your OpenAI API account has incurred $2,847 in unexpected charges from runaway agent usage — rotate your API key immediately to stop further billing\" or \"Claude API overage: $1,200 detected — log in now\" emails. Victims who click are taken to a phishing page that harvests their API key, OpenAI/Anthropic account credentials, or cloud billing credentials. A stolen API key enables continued billing fraud and model abuse. The signal fires when: (1) body references an AI API provider (OpenAI, Anthropic/Claude, Gemini, etc.) AND (2) runaway-spend, overage, unexpected charges, or API key rotation urgency is present AND (3) sender is NOT an official provider domain AND (4) no List-Unsubscribe or In-Reply-To. Source: GC1 R14 council #7; FBI advisory on AI API credential theft Q1 2026.","tier":"danger","category":"phishing","isThin":false}}