OpenRouter said on X on October 26, 2026 (13:25 Beijing time) that it had looked into an earlier post alleging that user records and API keys tied to OpenRouter were for sale on an underground forum. After that review, the company wrote that it had not found evidence of unauthorized access to its data, or validation of any of the claims in the post.
OpenRouter also said it will keep investigating and watching for signs of abuse. If a leak is verified or abuse is detected, it says it will take action and notify customers.
The original post, from DailyDarkWeb earlier the same day, framed the sale claim as unverified threat intelligence—not confirmation that OpenRouter was compromised. Specific counts circulating with that claim are not treated here as confirmed facts.
Rotating API keys and checking for unusual usage remain ordinary hygiene for OpenRouter traffic while the company continues its review. Related reading on API access controls: OpenAI Lets Admins Restrict API Service Tiers.