Stolen AI Credentials Fuel 'LLMjacking' Spree as Cloud Bills Balloon

Google security researchers are warning that a fast-growing criminal practice dubbed LLMjacking is turning stolen cloud credentials into a booming underground market, with victim organizations absorbing the cost. Attackers who lift API keys and service accounts from compromised systems are reselling access to large language models rather than using the capacity themselves. The result is a quiet drain on corporate AI budgets that can run for weeks before anyone notices.

The mechanics are straightforward. Once an intruder obtains a valid key for a commercial model endpoint, that key can be traded to buyers who want inference without paying for it or without passing the identity checks that legitimate providers require. Because the charges land on the account tied to the key, the original business keeps paying for queries it never made. Google's analysts describe underground forums and private channels where this access changes hands, often priced well below retail rates.

The financial exposure scales with usage. Inference on frontier models is metered by tokens, and a single compromised key attached to a production workload can generate thousands of dollars in charges in a matter of days. Companies running agent pipelines, batch processing or customer-facing chatbots are especially exposed because their keys are long-lived and their traffic is already heavy, making anomalous spikes harder to spot against normal variation.

Detection is the hard part. Most organizations monitor cloud spend at the monthly or departmental level, an interval far too slow to catch a credential being abused in real time. Google's guidance points toward tighter controls: scoping keys to specific models and quotas, rotating them on a short schedule, and alerting on usage that departs from established baselines. Centralizing key management and removing hardcoded secrets from code repositories closes off the easiest path attackers use to get in.

The pattern fits a broader shift in cloud crime, where attackers increasingly prefer to monetize access quietly instead of destroying data or demanding ransom. Stolen compute has long been resold, first through cryptocurrency mining and now through AI inference, which is simpler to abstract and easier to market to buyers who never touch the victim's systems. That distance makes attribution and takedown efforts slower for both providers and law enforcement.

What remains unsettled is how much of this activity providers and their customers can actually see. Model vendors can flag suspicious traffic patterns, but they cannot easily distinguish a resold key from a legitimate one until the bill arrives. Expect pressure on cloud and AI platforms to ship per-key anomaly detection and faster spend alerts, and watch whether insurers and auditors start asking pointed questions about how AI credentials are governed.