LLMjacking: The Rising Threat to AI Costs and Security
How cybercriminals exploit AI resources and inflate business bills
1The rise of LLMjacking
LLMjacking, a cybercrime trend targeting AI resources, has seen a major increase in 2026. Similar to cryptojacking, it involves stealing computing power, but focuses on AI models and resources. Cybercriminals exploit credentials or API keys to access business AI accounts, often with high or unlimited usage limits. This unauthorized access can lead to inflated billing, with costs potentially exceeding $100,000 per day for top-tier models.
2How LLMjacking works
Cybercriminals gain access to corporate networks through phishing, data breaches, vulnerabilities, or insider threats. Once inside, they steal credentials or API keys, granting them unauthorized access to AI models. These stolen credentials can also be sold on the underground market, where they are offered at discounts of up to 97%. Some traders even guarantee ongoing access if compromised accounts are revoked or closed.
3Financial impact on businesses
The financial damage from LLMjacking extends beyond inflated billing. Cybercriminals gain an economic advantage by using stolen AI resources to conduct attacks, while defenders face rising token costs. Enterprise companies are particularly vulnerable, with unauthorized usage potentially costing tens of thousands of dollars daily. The sophistication and capacity of AI models, such as those from OpenAI and Anthropic, exacerbate the issue by requiring more computing power.
4Phishing as a primary threat
Phishing remains one of the main causes of account theft or exploitation. Businesses must implement comprehensive training and awareness programs to mitigate this risk. Annual tick-box exercises are insufficient; continuous education is essential. Misconfigured instances, settings, and exposed data can also lead to LLMjacking, necessitating frequent audits and regular patch cycles to address vulnerabilities.
5Adopting least privilege
To defend against LLMjacking, organizations should adopt the principles of least privilege or zero trust. This framework ensures employees have access only to the resources they need for their work, reducing the risk of admin-level accounts being exploited. Hardcoded credentials and API keys should be avoided, and all credentials and keys should be rotated immediately if a security breach is suspected.
6Monitoring and response
Unusual AI usage, such as spikes in activity, should prompt immediate action. Businesses should consider temporarily revoking access and contacting their AI provider. Regular monitoring of AI usage patterns can help detect unauthorized access early. Security teams must be equipped with the time and capacity to run frequent audits and implement patch cycles to fix unpatched vulnerabilities.
7The underground market for AI access
The underground market for stolen AI credentials is booming. Cybercriminals sell access to AI models offered by companies like Anthropic, Google, and OpenAI at significant discounts. Some traders offer guarantees for ongoing access, even if compromised accounts are revoked. This market thrives on the high demand for AI resources, making it a lucrative venture for cybercriminals.
8The broader implications
LLMjacking not only inflates business costs but also shifts the economic advantage to cybercriminals. By leveraging stolen AI power, attackers can conduct sophisticated attacks at minimal cost, while defenders face escalating expenses. The rise of LLMjacking underscores the need for robust security measures, continuous monitoring, and proactive defense strategies to protect AI resources and mitigate financial risks.
Original article: Latest news — LLMjacking: The Rising Threat to AI Costs and Security