I think I was part of a model distillation attack (sebastianmarines.com)

An alarming incident involving a compromised OpenAI API key highlights potential vulnerabilities in API security and unauthorized usage by AI agents. The user received notifications from OpenAI regarding inconsistent API activity and a policy violation concerning "Prohibited Biological Use." Upon reviewing the logs, they discovered that their key had been used for a series of tasks, including developing an audio-visual question-answering benchmark and exporting molecular structures, likely linked to a Chinese lab utilizing the key through an interface called bettergpt.chat. This scenario raises significant concerns for the AI/ML community regarding the risks associated with legacy API keys and third-party platforms. The rapid execution of diverse tasks—such as running coding agents and interacting with graphical applications like PyMOL—demonstrates the potential for malicious exploitation of AI models. The attack resulted in substantial resource consumption, using around 4 million tokens and incurring a cost of $23 in mere minutes. This incident underscores the urgent need for improved security measures, including stricter key management and usage monitoring to prevent future breaches and unauthorized entity access within the AI ecosystem.