{"id":120460,"date":"2026-11-10T14:08:31","date_gmt":"2026-11-10T08:38:31","guid":{"rendered":"https:\/\/www.mygreatlearning.com\/blog\/what-is-llmjacking\/"},"modified":"2026-11-10T22:09:34","modified_gmt":"2026-11-10T16:39:34","slug":"what-is-llmjacking","status":"publish","type":"post","link":"https:\/\/www.mygreatlearning.com\/blog\/what-is-llmjacking\/","title":{"rendered":"LLMjacking Explained: How Hackers Hijack AI Infrastructure and How Developers Can Prevent It"},"content":{"rendered":"\n

Organizations are increasingly integrating large language models<\/a> (LLMs) into customer-facing applications, internal workflows, and developer tools. <\/p>\n\n\n\n

These systems depend on API credentials, cloud identities, model endpoints, and computing resources to deliver AI-powered services. <\/p>\n\n\n\n

However, weaknesses in these infrastructure components can expose organizations to unauthorized access, unexpected operational expenses, and misuse of their AI resources.<\/p>\n\n\n\n

For development teams, securing AI infrastructure involves more than protecting application data. They must also control who can access model services, monitor inference activity, and prevent unauthorized resource consumption. <\/p>\n\n\n\n

Understanding emerging attacks against LLM infrastructure is essential to building secure and reliable AI applications.<\/p>\n\n\n\n

\n

TL;DR<\/strong><\/p>\n\n\n\n

LLMjacking is a cyberattack in which hackers exploit stolen cloud credentials, exposed API keys, or unsecured LLM endpoints to use another organization's AI infrastructure. These attacks can cause unexpected inference costs, unauthorized model access, and cloud security breaches. Developers can prevent LLMjacking through secure credential management, least-privilege IAM, rate limiting, spending alerts, and continuous monitoring.<\/p>\n<\/blockquote>\n\n\n\n

What Is LLMjacking?<\/strong><\/h2>\n\n\n\n

LLMjacking is a cybersecurity attack in which threat actors gain unauthorized access to an organization's LLM APIs, cloud credentials, or model infrastructure to run their own AI workloads.<\/p>\n\n\n\n

Attackers typically target exposed model endpoints, leaked API keys, compromised cloud identities, or misconfigured AI gateways. Once they gain access, they can send requests to commercial or self-hosted models using the victim's computing resources and billing accounts.<\/p>\n\n\n\n

For example<\/strong>, suppose a company uses a cloud-hosted LLM to power its customer support application. A developer accidentally exposes a cloud credential in a public repository. <\/p>\n\n\n\n

An attacker discovers it, accesses the organization's cloud environment, and enables additional model services. The attacker then generates thousands of inference requests, leaving the company responsible for the resulting charges.<\/p>\n\n\n\n

According to Google Threat Intelligence Group's November 2, 2026 investigation, individual incidents generated more than $100,000 in fraudulent charges in a single day, with cumulative charges reaching $1 million at some organizations before access was revoked.<\/p>\n\n\n\n

How Does LLMjacking Work?<\/strong><\/h2>\n\n\n\n

LLMjacking is a cybersecurity attack in which threat actors gain unauthorized access to an organization's LLM infrastructure and use its resources to execute their own AI workloads.<\/p>\n\n\n\n

Attackers typically target exposed model endpoints, leaked API keys, compromised cloud identities, or misconfigured AI gateways. Once they gain access, they can send requests to commercial or self-hosted models using the victim's computing resources and billing accounts.<\/p>\n\n\n\n

For example, suppose a company uses a cloud-hosted LLM to power its customer support application. A developer accidentally exposes a cloud credential in a public repository. An attacker discovers it, accesses the organization's cloud environment, and enables additional model services. The attacker then generates thousands of inference requests, leaving the company responsible for the resulting charges.<\/p>\n\n\n\n

According to Google Threat Intelligence Group's<\/a> November 2, 2026 investigation, individual incidents generated more than $100,000 in fraudulent charges in a single day, with cumulative charges reaching $1 million at some organizations before access was revoked.<\/p>\n\n\n

\"\"<\/figure>\n\n\n\n

LLMjacking vs. Cryptojacking: What Are the Key Differences?<\/strong><\/h2>\n\n\n\n

LLMjacking and cryptojacking are both resource-hijacking attacks, but they target different infrastructure and serve different purposes.<\/p>\n\n\n\n

LLMjacking involves unauthorized access to an organization's LLM APIs, cloud credentials, or model infrastructure to run AI workloads. Attackers exploit compromised resources and transfer inference costs to the victim.<\/p>\n\n\n\n

Cryptojacking follows a different approach. Attackers compromise computing resources and use their CPU or GPU capacity to mine cryptocurrency without the owner's permission.<\/p>\n\n\n\n

Aspect<\/strong><\/td>LLMjacking<\/strong><\/td>Cryptojacking<\/strong><\/td><\/tr>
Primary target<\/td>LLM APIs and AI infrastructure<\/td>Computing resources<\/td><\/tr>
Main objective<\/td>Unauthorized AI inference<\/td>Cryptocurrency mining<\/td><\/tr>
Resources abused<\/td>API keys, tokens, model endpoints, GPUs<\/td>CPU and GPU capacity<\/td><\/tr>
Financial impact<\/td>Inference and cloud charges<\/td>Electricity and infrastructure costs<\/td><\/tr>
Common entry points<\/td>Leaked credentials and exposed endpoints<\/td>Malicious scripts and compromised systems<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

The key difference is that LLMjacking exploits access to paid AI services, whereas cryptojacking primarily exploits computing power. <\/p>\n\n\n\n

LLMjacking can also generate significant financial losses within hours rather than through gradual resource consumption.<\/p>\n\n\n\n

How Do Hackers Gain Unauthorized Access to LLM APIs?<\/strong><\/h2>\n\n\n\n

Google's investigations identify three broad stages in these attacks: initial access, lateral movement, and unauthorized model usage.<\/p>\n\n\n\n

1. Initial access through exposed credentials<\/strong><\/p>\n\n\n\n

Attackers target publicly exposed LLM endpoints, API keys, cloud IAM credentials, service account keys, GitHub Personal Access Tokens (PATs), and active session tokens.<\/p>\n\n\n\n

Google found that compromised cloud identity credentials were the dominant initial access vector across its investigated incidents.<\/p>\n\n\n

\"\"<\/figure>\n\n\n\n

2. Lateral movement and privilege escalation<\/strong><\/p>\n\n\n\n

After gaining access, attackers inspect cloud services, repositories, configuration files, and secret stores to discover additional credentials. They may create unauthorized service accounts, modify IAM permissions, or inject SSH keys to maintain access.<\/p>\n\n\n\n

Google also documented an incident involving privilege escalation through a vulnerability in the LiteLLM gateway, demonstrating why model-routing middleware requires security updates.<\/p>\n\n\n\n

3. Unauthorized model usage and monetization<\/strong><\/p>\n\n\n\n

Attackers enable additional model services, generate API keys, deploy proxy endpoints, or provision GPU resources. Some operators sell compromised model access through underground services known as LLM Mixers<\/strong>.<\/p>\n\n\n\n

These services aggregate unauthorized API access and resell it to subscribers through routing gateways.<\/p>\n\n\n\n

What Are the Warning Signs of an AI Infrastructure Attack?<\/strong><\/h2>\n\n\n\n

Developers and security teams should monitor model usage, cloud identity activity, and API gateway logs for unusual patterns.<\/p>\n\n\n\n

Common indicators include:<\/p>\n\n\n\n