LLMjacking Explained: How Hackers Hijack AI Infrastructure and How Developers Can Prevent It

Organizations are increasingly integrating large language models (LLMs) into customer-facing applications, internal workflows, and developer tools. 

These systems depend on API credentials, cloud identities, model endpoints, and computing resources to deliver AI-powered services. 

However, weaknesses in these infrastructure components can expose organizations to unauthorized access, unexpected operational expenses, and misuse of their AI resources.

For development teams, securing AI infrastructure involves more than protecting application data. They must also control who can access model services, monitor inference activity, and prevent unauthorized resource consumption. 

Understanding emerging attacks against LLM infrastructure is essential to building secure and reliable AI applications.

TL;DR

LLMjacking is a cyberattack in which hackers exploit stolen cloud credentials, exposed API keys, or unsecured LLM endpoints to use another organization's AI infrastructure. These attacks can cause unexpected inference costs, unauthorized model access, and cloud security breaches. Developers can prevent LLMjacking through secure credential management, least-privilege IAM, rate limiting, spending alerts, and continuous monitoring.

What Is LLMjacking?

LLMjacking is a cybersecurity attack in which threat actors gain unauthorized access to an organization's LLM APIs, cloud credentials, or model infrastructure to run their own AI workloads.

Attackers typically target exposed model endpoints, leaked API keys, compromised cloud identities, or misconfigured AI gateways. Once they gain access, they can send requests to commercial or self-hosted models using the victim's computing resources and billing accounts.

For example, suppose a company uses a cloud-hosted LLM to power its customer support application. A developer accidentally exposes a cloud credential in a public repository. 

An attacker discovers it, accesses the organization's cloud environment, and enables additional model services. The attacker then generates thousands of inference requests, leaving the company responsible for the resulting charges.

According to Google Threat Intelligence Group's November 2, 2026 investigation, individual incidents generated more than $100,000 in fraudulent charges in a single day, with cumulative charges reaching $1 million at some organizations before access was revoked.

How Does LLMjacking Work?

LLMjacking is a cybersecurity attack in which threat actors gain unauthorized access to an organization's LLM infrastructure and use its resources to execute their own AI workloads.

Attackers typically target exposed model endpoints, leaked API keys, compromised cloud identities, or misconfigured AI gateways. Once they gain access, they can send requests to commercial or self-hosted models using the victim's computing resources and billing accounts.

For example, suppose a company uses a cloud-hosted LLM to power its customer support application. A developer accidentally exposes a cloud credential in a public repository. An attacker discovers it, accesses the organization's cloud environment, and enables additional model services. The attacker then generates thousands of inference requests, leaving the company responsible for the resulting charges.

According to Google Threat Intelligence Group's November 2, 2026 investigation, individual incidents generated more than $100,000 in fraudulent charges in a single day, with cumulative charges reaching $1 million at some organizations before access was revoked.

LLMjacking vs. Cryptojacking: What Are the Key Differences?

LLMjacking and cryptojacking are both resource-hijacking attacks, but they target different infrastructure and serve different purposes.

LLMjacking involves unauthorized access to an organization's LLM APIs, cloud credentials, or model infrastructure to run AI workloads. Attackers exploit compromised resources and transfer inference costs to the victim.

Cryptojacking follows a different approach. Attackers compromise computing resources and use their CPU or GPU capacity to mine cryptocurrency without the owner's permission.

The key difference is that LLMjacking exploits access to paid AI services, whereas cryptojacking primarily exploits computing power. 

LLMjacking can also generate significant financial losses within hours rather than through gradual resource consumption.

How Do Hackers Gain Unauthorized Access to LLM APIs?

Google's investigations identify three broad stages in these attacks: initial access, lateral movement, and unauthorized model usage.

1. Initial access through exposed credentials

Attackers target publicly exposed LLM endpoints, API keys, cloud IAM credentials, service account keys, GitHub Personal Access Tokens (PATs), and active session tokens.

Google found that compromised cloud identity credentials were the dominant initial access vector across its investigated incidents.

2. Lateral movement and privilege escalation

After gaining access, attackers inspect cloud services, repositories, configuration files, and secret stores to discover additional credentials. They may create unauthorized service accounts, modify IAM permissions, or inject SSH keys to maintain access.

Google also documented an incident involving privilege escalation through a vulnerability in the LiteLLM gateway, demonstrating why model-routing middleware requires security updates.

3. Unauthorized model usage and monetization

Attackers enable additional model services, generate API keys, deploy proxy endpoints, or provision GPU resources. Some operators sell compromised model access through underground services known as LLM Mixers.

These services aggregate unauthorized API access and resell it to subscribers through routing gateways.

What Are the Warning Signs of an AI Infrastructure Attack?

Developers and security teams should monitor model usage, cloud identity activity, and API gateway logs for unusual patterns.

Common indicators include:

• Unexpected token consumption: Sudden increases in input and output tokens without corresponding application traffic.
• Unusual API requests: Requests originating from unfamiliar IP addresses, regions, or automated clients.
• Unauthorized credentials: Newly created API keys, service accounts, or access tokens.
• Unexpected model activation: AI services or premium model deployments enabled without approval.
• Abnormal billing: Rapid increases in inference costs or GPU resource consumption.
• Suspicious validation requests: Small requests, including max_tokens=1, used to test whether stolen credentials are valid.
• Disabled logging: Unexpected changes to cloud audit or model invocation logging configurations.

A particularly important signal is a mismatch between application traffic and model usage. If an application serves 500 requests but the LLM provider records thousands of model calls, security teams should investigate the discrepancy.

Monitoring becomes especially important when applications use autonomous agents that interact with external tools and coordinate multi-step tasks. 

Developers looking to understand how these systems are designed and governed can explore the Agentic AI course from IIT Bombay, which covers MCP, LangGraph, CrewAI, multi-agent orchestration, and human-in-the-loop design.

How Can Developers Prevent Unauthorized LLM Access?

Preventing these attacks requires securing credentials, restricting model access, and monitoring AI infrastructure continuously.

Microsoft also recommends managed identities instead of API keys, private endpoints, API gateway controls, and diagnostic logging for securing Azure AI deployments.

A practical implementation is to route application requests through a backend service instead of exposing permanent LLM credentials in frontend code. 

The backend authenticates users, validates request limits, retrieves credentials securely, and enforces model-specific quotas before forwarding requests to the provider.

Developers should also regularly patch model-routing middleware, container dependencies, and exposed AI endpoints. Monitoring low-volume credential validation requests and unauthorized cloud service activation can provide additional opportunities to detect attacks early.

What Should Organizations Do After an AI Security Breach?

If unusual model activity or unauthorized cloud access is detected, organizations should respond immediately.

1. Revoke compromised credentials: Disable exposed API keys, access tokens, and unauthorized service accounts.
2. Review IAM permissions: Identify newly created users, modified roles, and unexpected administrative privileges.
3. Stop unauthorized workloads: Disable suspicious model deployments, GPU instances, and proxy services.
4. Inspect audit logs: Identify unfamiliar API requests, IP addresses, model invocations, and changes to logging configurations.
5. Rotate remaining secrets: Update related cloud credentials and application secrets that may have been exposed.
6. Investigate financial impact: Review token consumption, cloud usage, and billing records to identify unauthorized charges.

Organizations should preserve relevant logs before removing compromised infrastructure so security teams can reconstruct the attack, identify the initial entry point, and prevent similar incidents.

Beyond application-level safeguards, developers also need to understand how AI systems are deployed, scaled, and monitored in production environments. 

Building these capabilities involves working with distributed ML systems, containerized workflows, CI/CD pipelines, and production monitoring. The AI Engineering course from IIT Bombay covers these engineering areas through hands-on learning focused on building and managing scalable AI infrastructure.

Final Thoughts

LLMjacking demonstrates that AI infrastructure introduces new security and financial risks beyond traditional application vulnerabilities. 

Compromised cloud identities, exposed model endpoints, and excessive permissions can allow attackers to exploit expensive AI resources without directly compromising the underlying model.

For developers, preventing these attacks requires more than protecting API credentials. Secure identity management, restricted model access, continuous usage monitoring, and controlled inference workflows must become part of AI application development.

As organizations deploy more LLM-powered applications and autonomous agents, securing the infrastructure behind them will be just as important as securing the applications themselves.

Frequently Asked Questions About LLMjacking

1. Is LLMjacking the same as prompt injection?

No. LLMjacking involves unauthorized access to and abuse of AI infrastructure, whereas prompt injection manipulates an LLM's instructions to influence its behaviour.

2. Can attackers perform LLMjacking using leaked API keys?

Yes. Attackers can use exposed API keys to send unauthorized requests to model providers, consume token quotas, and generate charges against the compromised account.

3. Does LLMjacking affect self-hosted LLMs?

Yes. Exposed self-hosted inference endpoints, GPU servers, and model gateways can be abused to run unauthorized workloads and consume computing resources.

4. Can rate limiting completely prevent LLMjacking?

No. Rate limiting reduces excessive usage but cannot prevent every attack involving compromised credentials, privilege escalation, or unauthorized cloud resources. It should be combined with access controls and monitoring.

5. How is LLMjacking different from model theft?

LLMjacking abuses access to existing model infrastructure to consume inference resources. Model theft involves obtaining proprietary model weights or other protected model assets without authorization.

References

• Google Threat Intelligence Group and Mandiant: The Rise of LLMJacking (November 2, 2026)
• Microsoft: Azure AI Security Best Practices
• OWASP Top 10 for LLM and Generative AI Applications