Definition
LLMjacking is LLMjacking is an attack in which criminals steal cloud credentials or API keys, then use or resell access to the victim's hosted AI models while the victim pays the bill.
LLMjacking is the AI version of hijacking someone's account to run up their bill. An attacker gets hold of valid credentials for a cloud account or an AI service, then uses the victim's access to large language models for free, or sells that access to others. The victim receives the invoice.
Security researchers at Sysdig named the technique in May 2024, after observing attackers who used stolen cloud credentials to reach hosted language model services. The word echoes cryptojacking, where criminals steal computing power to mine cryptocurrency. The stolen resource here is model access instead.
The first step is getting credentials. In the campaign Sysdig described, attackers exploited a vulnerable web framework to pull cloud keys off a server. Other common routes include keys accidentally published in public code repositories, phishing, and malware on a developer's machine.
Next, the attacker checks which model services the stolen account can reach. Scripts can test keys against many providers quickly. Some attackers then set up a reverse proxy, a middleman server that lets many paying buyers route requests through the one compromised account.
The attacker may also try to hide the activity, for example by changing logging settings so the usage is harder to spot.
Running a top model is expensive, and access to restricted or heavily rate-limited models is valuable. Sysdig's researchers estimated that abuse of a single account could rack up tens of thousands of dollars in model usage per day. The buyers are often people who want to use models without paying, or to generate content a provider would block under their own account.
Most protections are basic hygiene applied to API keys and access tokens:
If you suspect a key is stolen, revoke it first, then investigate.
Prompt injection and data poisoning attack how a model behaves or what it learned. LLMjacking attacks the account in front of the model. It needs no clever prompt, only a valid key, which is why it is classed with supply chain attacks and credential theft rather than with model security.
The takeaway: an AI key is a credit card with no limit unless you set one.
LLMjacking is stealing cloud or API credentials to use, or resell access to, someone else's hosted language models while the victim pays for the usage.
Keep keys out of code, scope them narrowly, rotate them, set spending caps and alerts, and monitor logs for unusual model usage.
Fireworks AI says an attacker used a cloud provider's October 23 breach to reach its development machines and accessed some customers' incomplete model weights, datasets and secrets. Its inference was not hit. Rotate your keys anyway.