Alibaba Cloud’s Token Plan has officially been connected to the Qwen app and PC client, allowing users to use the same subscription quota inside Qwen’s Work Assistant after binding a dedicated API key. Once connected, users can spend their existing plan credits on more complex tasks, including operating a computer and browser, calling Skills, and creating Office documents, apps, and websites. The update extends a single pool of model usage from developer-focused tools into Qwen itself, rather than limiting it to coding and agent environments. Token Plan already supported tools such as Codex, Claude Code, Cursor, Qoder, and OpenClaw, and those credits can now also be shared with Qwen Work Assistant. Supported models include Qwen3.8-Max, with different models and tools drawing down usage under a unified Credits-based deduction system.

ChainCatcher, citing Security Affairs, reported that Ransomnews researchers documented a large-scale leak of Stripe merchant API keys. The exposed keys were found in public code repositories, GitHub Actions logs, and misconfigured web servers. Researchers identified more than 50,000 unique keys, and sample testing found that a substantial portion was still active. The report said attackers could use the keys to commit fraud within hours. According to the report, a data set posted on a data-trading forum on Aug. 18, 2026 contained valid Stripe API keys for 659 merchant accounts, along with about 35 GB of customer and payment data. Ransomnews analyzed the data offline and reported it to Stripe before publication. The report said Stripe itself was not breached and that the leaked keys belonged to merchants, not Stripe. Researchers said that once a valid key was found, it took as little as 17 hours to access customer lists, create fraudulent payment links, and run a $1 test charge. The report also said valid keys could be used to list customers and stored payment methods, create charges and payment intents, issue refunds to attacker-controlled accounts, change webhook endpoints to intercept payment notifications, and access connected accounts when Stripe Connect was enabled.

Anthropic stopped allowing third-party tools to use Claude subscription quotas from April 4. OpenClaw responded by advising users to switch to API keys or use alternatives such as Codex, Qwen, and Kimi.

NVIDIA’s build.nvidia.com platform offers free API keys for more than 100 models. New users get 1,000 credits, with the option to request up to 5,000 credits total under the free tier.

Security firm SlowMist reports multiple Clawdbot instances publicly accessible due to misconfiguration, exposing API keys, bot tokens, OAuth secrets, and months of private chat logs to attackers.

Hackers exploited a Gnosis Safe module vulnerability to drain $3.2 million from 86 wallets on Base and Ethereum. PeckShield and Blockaid detailed the attack path; Squid team disowned the module; CZ warned developers about API key risks.

After Vercel disclosed a security incident, crypto teams began rotating API keys and reviewing code and deployment settings. The breach was traced to a compromised Google Workspace connection tied to Context.ai.

A New Zealand trader lost 7 BTC ($18,000) on Bittrex after hackers accessed his API keys, likely exposed in a tutorial video. He urges never to keep large sums on exchanges.