API Key Compromise Scenario
A leaked API key is spend before it's a headline: an attacker (or an agent) with a valid key can drive transactions. The eval gym tests what the firewall does.
The scenario
A valid key leaks (repo, logs, prompt).
Attacker-driven requests begin spending immediately.
Traditional detection finds it after the fact.
What the firewall does
Caps bound the damage per agent and per window.
Velocity limits stop automated bursts.
Merchant allowlists stop unknown destinations.
The audit log shows exactly what moved.
The honest limit
The firewall can't un-leak a key — it limits the blast radius and logs it.
FAQ
Is this scenario in the eval gym?
Yes — key-compromise is one of the 53 eval scenarios, 53/53 passing.
What else should I do?
Rotate keys fast and put spend limits on every key — both.
Related
Stop the next $12,400 night.
One API call (or MCP tool) in front of every agent transaction — APPROVED, BLOCKED, or FLAGGED, deterministic, ~5 ms, fully logged.
See plans — from $99/mo Try a live check