LLMjacking

What is LLMjacking?

LLMjacking is the theft of cloud credentials in order to use somebody else's access to language models. The attacker does not want your data. They want your quota, because model access costs money and a stolen account is free.

The Sysdig Threat Research Team gave it the name in May 2024, after finding an attack in which stolen credentials were used against ten different cloud-hosted model services. The initial access in that case came from a vulnerable Laravel installation, exploited through a known vulnerability from 2021, which is worth sitting with for a moment. The AI part of the attack was the payload. The way in was an unpatched web application, the same as it has been for twenty years.

How the attack runs

The pattern is consistent enough to describe as a sequence.

1. Credentials are obtained. Through a vulnerable application, a key committed to a public repository, a leaked configuration file, or a compromised laptop. Nothing here is specific to AI.

2. The credentials are tested against every model service. Attackers run a checker script across providers to see which ones the key opens. In the original case the tooling checked ten services, including AWS Bedrock, Azure, Google Vertex AI, OpenAI, Anthropic and Mistral.

3. Access is enabled where it was not already on. In later variants, attackers went beyond using what was available and actively enabled additional models on the victim's account through the provider's own API calls. So a model you never turned on is not protection.

4. Access is resold. This is the commercial part. A reverse proxy sits in front of the stolen accounts and offers model access to paying users, while hiding the underlying credentials. The buyers get cheap access and often an interface with the usual restrictions removed, and the victim gets the invoice.

What it costs the victim

The numbers Sysdig published are from 2024, so read them as a snapshot of that period rather than as a current price. They still give you the order of magnitude.

Their first estimate put the worst case at over 46,000 US dollars per day in model consumption for a single compromised account, calculated on the Claude 2 pricing of the time at maximum quota across four regions. In follow-up research they revised that upward, to more than 100,000 dollars a day when the most expensive models of the moment were being used.

The volume matters as much as the price. In one observed case, over 85,000 model requests were recorded, with 61,000 of them inside a three-hour window. This is not a slow leak that shows up on a monthly review. It is a spike that can run up a serious bill overnight.

How attackers stay hidden

Two developments are worth knowing, because they both target exactly the thing you would use to catch this.

They turn the logging off. Attackers were seen deleting the model invocation logging configuration, which switches off the detailed logging of prompts and responses. The general cloud audit trail keeps recording API calls, so the action itself remains visible, but the detail of what was being asked disappears.

They use the newer API. When AWS released a new conversational API for its model service, attackers adopted it within about a month. The reason was practical: calls through the new interface did not produce the same log entries as the older one, so detections built on the old call name saw nothing.

The lesson from both is the same. Detection built on one specific log line is fragile. Detection built on cost and on volume is much harder to evade, because the whole point of the attack is to consume.

How you spot it and how you prevent it

Put a budget alert on model spend. This is the single highest-value control, and it is usually the fastest to implement. An account that normally spends a few euro a day and suddenly spends hundreds should page someone the same day.

Only enable the models you use. Every enabled model is available to whoever holds the key. Keep the list short, and watch for models being enabled that nobody requested.

Keep model invocation logging on, and alert when it is switched off. The act of disabling logging is itself a strong signal, and it shows up in your cloud audit trail.

Get rid of long-lived keys. Managed identities and short-lived credentials remove the thing being stolen. An LLM gateway helps here too, because your applications then never hold a model key at all.

Watch for the unusual pattern, not just the volume. Requests from a region you do not operate in, at hours nobody works, against a model your team does not use.

Fix the ordinary vulnerability. The way in was an unpatched application. Your model access is only as protected as the least maintained system that holds a credential.

What to watch out for with LLMjacking

The first sign is often the bill. If nobody looks at cloud spend until month end, an attacker has weeks. Daily thresholds beat monthly reviews.

It is not only a cost problem. Your account is being used to generate content you have no visibility over, under your organisation's name. That is a reputational and legal exposure on top of the invoice.

A development subscription is a real target. Test and development environments hold real keys with real quota and get a fraction of the monitoring attention.

Keys in a repository are still the classic route. Scanning your repositories for credentials is dull, cheap and repeatedly the thing that would have prevented the incident.