LLMjacking is the theft and abuse of cloud AI access. An attacker who obtains your API keys or cloud credentials uses them to run hosted large language models on your account: running up your bill, moving data through the model, or reselling the access to others. The defenses are the same as for any leaked secret, plus AI-specific controls: vault and rotate keys, enforce least privilege on model endpoints, cap spend, and alert on model usage that does not match your traffic.
What LLMjacking is
LLMjacking is credential abuse aimed at your cloud AI. Managed model services let you call powerful large language models with an API key or a cloud identity. If an attacker gets that key or identity, they can invoke those models directly, on your account and your bill.
The attacker is not breaking the model. They are borrowing your access to it. That means every prompt they run, every token they spend, and everything the model does under your name is attributed to you.
How the access is stolen and abused
The credentials usually leak the same way any secret does:
- Keys committed to code or left in public repositories and build logs.
- Exposed configuration: environment files, unprotected buckets, or debug endpoints.
- Compromised CI/CD and developer machines that hold model keys.
- SSRF and metadata theft that hands over a cloud role with model permissions.
Once in, attackers script high-volume calls, sometimes routing many outside users through your access with a reverse proxy, and often try to disable logging or alerts so the usage stays quiet.
Why it hurts
LLMjacking is expensive and revealing:
- Runaway cost: high-end models are not cheap, and automated abuse scales fast.
- Data exposure: prompts and outputs can carry sensitive data, and the account may hold connected data sources.
- Liability: your account can be used to generate abusive or policy-violating content in your name.
- A bigger breach: the credential that unlocks the model often unlocks more, so LLMjacking is frequently an early signal, not the whole story.
How to prevent LLMjacking
Treat model access as a top-tier secret and watch how it is used:
- Vault and rotate model keys, and keep them out of code, images, and logs.
- Least privilege: scope each key and identity to the model endpoints it needs, with per-key quotas.
- Hard spend caps and anomaly alerts on token and request volume, so a spike pages someone.
- Keep audit logging on and actually monitored, including new model deployments and calls from unfamiliar regions.
- Scan repositories and CI for leaked keys, and restrict which identities may call model APIs at all.
References
- [1]OWASP Top 10 for LLM Applications(OWASP)
- [2]Adversarial Threat Landscape for AI Systems(MITRE ATLAS)
- [3]Cybersecurity Best Practices(CISA)
LLMjacking turns a leaked key into someone else’s compute budget. Protect model credentials like the crown jewels they are, cap what any one key can spend, and watch for usage that does not match your traffic.