Attackers steal keys from exposed repositories, leaked configuration or compromised platforms, then run expensive models, resell the access, feed it into automated attack tools or use it for distillation. Spending caps, one key per app, rotation after breaches and per-key usage alerts limit the damage. Using someone else's key without permission is generally unauthorized access or fraud.