LLMjacking: Where It Came From, How It Works and Why Your Bill Is the Evidence

People visit pirate websites hundreds of billions of times a year. The piracy-tracking firm MUSO counted 216.3 billion visits in 2024, and the United States sent more of that traffic than any other country, about 26.7 billion visits. In a May 2024 YouGov survey, 18% of Americans said they had acquired TV shows, movies, work software or other content illegally.

One such user was WorriedAssociate7029., who got hacked while attempting to download a pirated game.

In late August 2026, the Reddit user posted an email from Anthropic warning that someone was draining tokens from their Claude account. “Apparently, the hacker stole all my Google Chrome credentials, including cookies and session IDs, which allowed him to bypass all two-factor authentication security measures,” they wrote.

They were not alone. Anthropic told affected users they had found six families of credential-stealing malware on their machines. Around the same time, Okta researchers went through a single free dump of stolen data covering 5,871 infected computers. One of them had been infected by a trojanized copy of the strategy game Hearts of Iron IV, and it held OpenAI and ChatGPT session data.

The pirate thought he was the one doing the stealing. The person robbing him had no interest in his game library. What they wanted was his paid access to a frontier AI model.

This is called LLMjacking.

Today’s AI tools can turn three coders in a basement into a multimillion-dollar company. The same tools can also bring a multimillion-dollar company to its knees. Attackers have noticed, and they’re targeting one of the weakest links in this new economy: API keys.

Large language models (LLMs) have transformed the business landscape — and they’ve given rise to new cybersecurity threats.

What it is

Sysdig’s threat research team coined the term in May 2024 after watching attackers use stolen AWS credentials to reach Claude models hosted in a victim’s cloud account. LLMjacking occurs when someone gets unauthorized access to a large language model, uses it, and the legitimate owner pays.

Attackers who engage in AI resource hijacking are not typically trying to steal the underlying AI model. The goal is to target access credentials, cloud permissions, or the AI infrastructure that enables interaction with the model.

Often, victims of LLMjacking are unaware that the hijacking has occurred, because their own interaction with the LLM is unaffected.

Model weights sit on the provider’s servers, and stealing them is a different and much harder crime. LLMjackers want the right to make the model do work while someone else gets the invoice. Every token costs money, and a valid credential is a voucher for as many tokens as the account allows.

A credential is a claim that whoever holds it is you. The provider has no way to check that claim beyond the credential itself. LLMjacking lives in that gap. It can leave victims with unexpectedly high cloud costs, exposed data, compliance violations, and reputational damage.

Nothing about the attack breaks the victim’s own use. Their app keeps working and their prompts still come back. The first symptom is usually the bill.

How expensive it gets

Sysdig’s first estimate was that a hijacked account could cost its owner more than $46,000 a day. By September 2024, with attackers moving to Claude 3 Opus, that estimate passed $100,000 a day.

On July 11, 2024, Sysdig logged 61,000 requests to Amazon Bedrock in a three-hour window. One victim owed $30,000 after three hours.

The cases have grown since. In August 2026, Palo Alto Networks’ Unit 42 reported handling cases where exposed credentials were plugged into a resale service within minutes, running up nearly $1 million in charges before anyone contained them.

A month later, the AI evaluation nonprofit METR disclosed that an attacker had used one stolen key to spend about $600,000 in model credits over three weeks in March 2026. Nobody noticed, partly because METR’s normal workload already looked like abuse. The credits had been donated, so METR paid nothing. A paying customer would have.

LLMjacking can happen to any organization that uses cloud-hosted LLMs, including those that use services offered by providers like OpenAI and Anthropic, as well as those with self-hosted models. This form of attack has caused extensive losses, with some victimized companies facing bills of more than $100,000 per day.

How the attackers get in

LLMjacking can take different forms, but every LLMjacking attack needs one thing: a credential the provider will accept. There are only a few ways to get one, and all of them are in use.

Leaked Keys: API keys allow external software, apps, and custom code to communicate directly with AI models. These keys can be used to authenticate requests, to control access by confirming that the account has permission to use the API models, and to track billing and usage.

Unfortunately, API keys can be exposed through employee devices, configuration files, insecure code repositories, or poorly protected servers. Once an attacker obtains a company's API key, they may be able to access AI services with the same permissions as the legitimate application or account.

GitGuardian counted about 1.28 million leaked secrets tied to AI services on public GitHub in 2025, up 81% from 2024. When Entro Security deliberately leaked working AWS keys on GitHub, Pastebin and Reddit, attackers tried them within 17 minutes on average and within nine at the fastest. Their first moves were to check what the account could do, then try to call AI models.

Stolen cloud accounts: Sysdig’s original case started with an unpatched Laravel server. From there the attackers pulled AWS credentials and went looking for Bedrock. In later cases they switched on models the victim had never enabled.

Companies commonly use cloud platforms to access LLMs. Unfortunately, when attackers compromise cloud accounts due to weak passwords or missing multifactor authentication, they can gain unauthorized access to AI services.

Infostealers: This is where the pirate comes in. Stealer malware copies browser cookies, saved passwords, session tokens and, increasingly, API keys from config files. Okta found that newer variants search specifically for Anthropic and OpenAI-style keys.

Its sample held 561 unique Anthropic session tokens, 164 of them still unexpired. A stolen session skips the password and the second factor, because as far as the server can tell, the login has already happened.

AI applications have multiple components, and a weakness in any one of them could allow attackers to manipulate how the application interacts with the LLM.

Components that could be compromised include: the user interface, databases, plugins, retrieval systems, authentication systems, and external APIs.

Attackers who access these systems could potentially exploit insecure application logic to obtain sensitive details, use the model for their own purposes, resell access to AI inference, or bypass other restrictions.

Careless apps: METR’s leak came from a quickly built app with a bug that switched off its own authentication. METR suspects the attacker found it by scanning newly registered sites for AI-related keywords, hunting for exactly this kind of exposed key.

In July 2024 Microsoft found a network it tracks as Storm-2139 using API keys leaked by multiple Azure OpenAI customers. The group stripped out safety controls, generated non-consensual intimate images of celebrities and resold the access. Microsoft sued in December 2024 and, in February 2025, named developers in Iran, the United Kingdom, Hong Kong and Vietnam.

Abusing AI-as-a-service platforms: AIaaS platforms are becoming increasingly popular, providing more opportunities for abuse tactics that are related to LLMjacking. Abusing legitimate AI services for command-and-control communication involves using malware to make malicious traffic appear normal while stealing data and sending inappropriate instructions through a legitimate AI cloud service.

When jailbreaking, attackers bypass AI guardrails to enable the LLM to generate content or perform actions that its safeguards typically prohibit. Attackers may use techniques such as writing carefully crafted prompts or exploiting application vulnerabilities to generate malicious content or potentially expose sensitive data.

Attackers who perpetrate these abuses often resell access gained through unauthorized means on a black market.

Who buys stolen access

Stolen access is a product, and it has a market. The common resale is a reverse proxy that pools stolen keys behind a single endpoint and rents out the pool. When DeepSeek released its models, Sysdig found one proxy already holding 55 DeepSeek keys. Another charged $30 a month. DeepSeek-R1 was reachable through a compromised proxy one day after its release.

There is also a larger gray market of “transfer stations,” resellers that advertise cheap frontier-model access on marketplaces such as Taobao. A reseller can’t profit by buying tokens at full price and selling them at a discount, and this is where stolen tokens help.

There are all kinds of buyers in this market, some are developers who want cheap inference, others are residents of countries which are sanctioned from accessing American AI models.

Sysdig documented Russian users running stolen access for university projects. Some want a model without its safety filters. Unit 42 warns that state-backed groups can use the same services to train their own models for a fraction of the cost.

A request made with a stolen key is the same request the owner would make. The key is valid and the signature checks out. If the attacker routes traffic through a proxy and keeps the volume plausible, nothing in the request says theft. Billing runs on a cycle, so the evidence piles up in a place nobody looks until the month ends. METR lost three weeks that way, because heavy usage was normal for them.

How to prevent LLMjacking

Companies can reduce the risk of compromised API keys by regularly rotating credentials, using secure systems to store them, refraining from embedding them directly in application code, and imposing restrictions on API access. They can also monitor their repositories for exposed credentials.

Preventing LLMjacking is critical and can help your business avoid surprise bills, potential exposure of proprietary data, legal risks, and reputational damage. Fortunately, there are options to reduce the risk.

Some of the key steps your company can take include:

• Treat every API key as a password with a credit card attached. Keep keys out of code, store them in a secrets manager, scan repos and chat tools for leaks and revoke anything exposed at once.
• Use short-lived credentials where you can, and scope each key to the models and permissions it needs, and set hard spending caps and alerts one every account and key.
• Your company should have a strong system to ensure that only authorized parties can access LLMs. This can include multifactor authentication, role-based permissions, and regular access reviews. You may also want to consider using separate accounts for development and production environments.
• Protect developer machines. Ban cracked software, and treat any infostealer infection as a full reset of passwords, sessions and keys, AI accounts included.
• Your security team can set up alerts that quickly flag abnormal AI activity, such as sudden spikes in API requests, requests from unfamiliar locations, or usage outside routine business hours.
• AI security should be at the forefront during the software development process. Ensure your developers limit plugin permissions, protect system prompts, validate user inputs, test applications for any vulnerabilities, and conduct security reviews before deploying products.

While these steps can help reduce the risk of LLMjacking, the reality is that there is substantial financial incentive for criminals to hack LLMs for resale, for personal use, or to access advanced AI models from certain countries where the U.S. government has imposed restrictions.

Traditional security controls are helpful in protecting credentials and infrastructure, but aren't always enough to detect and stop LLMjacking. None of it solves the core problem, which is that a valid stolen credential produces traffic the provider can’t tell apart from yours.

If you want to know whether someone else is already spending your tokens, talk to us.

Vectoral was built for that problem. Instead of asking whether a credential is valid, it asks whether the traffic behaves like you. It uses behavioral fingerprints and request-graph clustering to pick out traffic that belongs to a reseller or proxy, and blocks it at your endpoints.

If you want to know whether someone else is already spending your tokens, talk to us.