FYI: OpenAI "spend limits" aren't always limits
Summary not yet generated for this article.
Original Text
My OpenAI API key got hacked this morning, and the bot started using my key for something in Chinese.
"No worries," I thought, "I have a $30 spend limit setup." When I came back to my desk an hour later, I had $285 in unauthorized charges.
As it turns out, OpenAI will let you create a spend limit _without_ checking "enforce spend limit." If you don't check enforce, it's meaningless. So even though my account showed that I had a $30 spend limit, it still let the hacker blow right past it by hundreds of dollars.
I've submitted a dispute, but wanted to let other people know so it doesn't bite you, too. You can check your spend limits at https://platform.openai.com/settings/organization/limits
Comments (1 of ) ⌛