Cybercriminals are increasingly hijacking companies’ artificial intelligence accounts and exposed model servers to steal computing power, resell access to premium AI models and run automated hacking tools at someone else’s expense.
Security researchers call the technique “LLM-jacking”. Instead of stealing a database or encrypting files for ransom, attackers compromise cloud credentials or unsecured AI infrastructure and use the victim’s access to expensive large language models.
The threat is growing as businesses rapidly deploy AI services from providers such as Amazon, Google, Microsoft, Anthropic and OpenAI without always applying the same security controls used for traditional cloud infrastructure.
Proposal for Conducting Cyber Crisis Drill, Tabletop Exercise (TTEx) & CCMP Readiness Exercise
Attackers steal credentials and consume the victim’s AI budget
The basic attack can begin with something as simple as a leaked cloud credential.
Researchers at Sysdig first documented attackers stealing credentials and using them to access cloud-hosted AI services, including Amazon Bedrock. The compromised account owner remained responsible for the bill while the attacker consumed the model.
Once inside, criminals can check which AI services and models are enabled, create access routes to those services and then pass the stolen capability to other users.
Sysdig found evidence of reverse proxies being used to provide access to compromised models.
That effectively turns the victim’s AI account into an underground service.
The attacker does not need to pay for the infrastructure because the legitimate company carries the cost.
A single compromised account can become extremely expensive
AI inference can be costly at scale.
Sysdig estimated that, in a worst-case scenario, unauthorised use of a single Claude model could generate charges of up to $46,000 per day.
That risk becomes greater when criminals automate requests or sell the stolen access to multiple users.
Unlike a one-time fraudulent transaction, the cost can continue growing until the company detects the abnormal activity and revokes the compromised credentials.
For organisations running large AI workloads, unusual model usage can therefore become both a cybersecurity incident and a major financial problem.
Exposed AI servers are becoming another target
Attackers are not limiting themselves to commercial cloud accounts.
Researchers are also seeing criminals abuse poorly secured self-hosted AI servers.
Sysdig reported in June that attackers were using misconfigured Ollama servers as the reasoning engine for an automated offensive security tool.
Ollama is widely used by developers to run large language models locally.
The software can listen on a network port without authentication by default, meaning an internet-exposed server may effectively provide free AI computing power to anyone who discovers it.
Researchers cited estimates of roughly 175,000 publicly exposed Ollama instances across more than 130 countries.
That does not mean every exposed server has been compromised.
It does show how quickly AI infrastructure can become a new attack surface when it is placed online without authentication or network restrictions.
Stolen AI is now being used to support hacking itself
The latest evolution is more concerning.
Sysdig observed a threat actor using stolen AI compute not merely for chatbot access, but as part of a multi-stage offensive security tool.
The system could identify targets, scan them for vulnerabilities, compare weaknesses against known flaws, generate proof-of-concept exploits and attempt further intrusion.
Researchers said the development represents a convergence of two trends: theft of AI resources and the use of AI agents in cyber operations.
Earlier LLM-jacking was largely about free model access and resale.
Now the same stolen infrastructure can potentially help automate attacks against additional victims.
That means one compromised AI server could be used as a stepping stone for other cybercrime.
Criminal markets can resell stolen model access
There is also a clear financial incentive.
Attackers can create proxy services that route requests through compromised AI accounts and sell that access to other users.
Those customers may believe they are paying for a cheap or unrestricted AI service while the underlying requests are actually being processed through someone else’s stolen account.
Researchers say this can help criminals avoid normal usage controls and potentially gain access to models they could not otherwise afford or use directly.
The structure is similar to other underground markets.
Instead of selling stolen credit cards or compromised servers, criminals are selling access to stolen AI capacity.
AI infrastructure is now part of the cloud-security problem
The rise of LLM-jacking also shows that AI security is not only about prompt injection, hallucinations or model poisoning.
Many of the attacks begin with ordinary cloud-security failures.
Leaked API keys, exposed credentials, outdated software, excessive permissions and internet-facing services can all create a route into AI infrastructure.
Once attackers obtain access, however, the consequences are different because AI resources can be expensive and highly reusable.
A compromised storage bucket may expose files.
A compromised AI account can keep generating value for an attacker every minute it remains available.
That changes the economics of the intrusion.
Businesses may miss the attack until the bill arrives
LLM-jacking can also be harder to notice than some traditional attacks.
The company’s AI service may continue functioning normally while criminals use it in parallel.
Employees may see no obvious outage.
The first warning could instead be an unexpected spike in token consumption, cloud spending or model requests.
Security teams therefore need to monitor AI usage patterns in the same way they track unusual cloud logins, data transfers or cryptocurrency-mining activity.
Sudden model usage from new locations, unfamiliar API behaviour or sharp increases in spending can all be warning signs.
Basic cloud controls still matter
The defence against LLM-jacking is not entirely new.
Companies should rotate and protect API keys, restrict AI services to the identities that actually need them and avoid exposing local model servers directly to the internet.
Cloud audit logs and billing alerts can also help detect abnormal usage before costs spiral.
For self-hosted models, authentication and network access controls are particularly important.
Businesses should also treat AI inference endpoints as production infrastructure rather than experimental developer tools.
The more powerful and expensive AI becomes, the more attractive those resources become to criminals.
What this means for you: Companies using AI should monitor model usage and cloud bills just as closely as they monitor login attempts and data access. A stolen AI credential may not immediately expose customer data, but it can still allow criminals to run expensive models and offensive tools using the company’s money and infrastructure.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
