Pieter Levels reports a dormant OpenClaw key used for Claude API charges

• Pieter Levels says a Claude API key tied to a retired OpenClaw setup generated a billing alert months after he shut its VPS servers down, according to levelsio's report.
• The attached dashboard records 48.0 million input tokens under Claude Fable 5.1, with a 99.3% cache-read ratio, as levelsio's usage screenshot shows.
• The access path remains unconfirmed: Levels said in a levelsio reply that he suspected “OpenClaw something,” not necessarily the VPS itself.
• The credential was an API key, not a normal Claude login, Levels clarified in a levelsio reply.

The dashboard in levelsio's post places the burst between September 10 and 11. OpenClaw's secrets documentation specifically names retired auth-profile JSON archives as a place plaintext credentials can remain agent-readable.

Pieter Levels, posting as levelsio, wrote that he had retired his OpenClaw VPS servers months earlier when a separate Claude account used for that setup received a billing alert. He said the account had no auto-reload enabled and that he deleted the account after finding the usage.

Levels also wrote that none of the terminal or VPS sessions he checked used the API. His post gives neither a dollar figure nor a confirmed party or method behind the requests.

The dashboard attached to levelsio's post breaks the account's input usage across four model labels:

• Claude Fable 5.1: 48.0 million input tokens, 99.3% read ratio, 25.3x write amortization.
• Claude Fable 5: 889,000 input tokens.
• Claude Sonnet 5: 66,000 input tokens.
• Claude Haiku 4.5: 16 input tokens.

Its time chart concentrates the Fable 5.1 activity on September 10 and 11, almost entirely as cache reads. The screenshot establishes metered usage, not who issued the calls.

Responding to a question, Levels identified the credential as an API key in a levelsio reply. He added that keys are stored so Claude can access the API, in another levelsio reply, but did not identify the file, service, or configuration surface involved.

He said he thought the exposure may have come through “OpenClaw something,” rather than the retired VPS. A later levelsio reply linked back to the usage image but supplied no exploit chain.

OpenClaw's secret-management guide says SecretRefs can replace plaintext credentials in supported configuration, although plaintext remains supported. It lists four places an agent may be able to read a plaintext credential:

• openclaw.json
• .env files
• retired auth-profile JSON archives
• generated agents/*/agent/models.json files

The guide says SecretRefs reduce this local exposure only after supported credentials have migrated and openclaw secrets audit --check finds no plaintext residue. Its related secrets-tool documentation says an agent can request a credential while receiving only entry metadata and a store reference, rather than the value itself.

Those docs do not identify the source of the credential in Levels' report. Anthropic's API release notes say the Claude Console also supports personal and service-account keys, with workspace scoping and per-account usage tracking.