When a developer wants to add an AI model to a product, they get an API key from the provider, OpenAI, Google, Anthropic or a cloud company: a long string of characters that identifies them and lets them send requests to the model. Every request is logged to the key owner's account and billed by usage. Whoever holds the key can use the service, and pay for it, without knowing a password or passing any extra verification.
LLMjacking, a blend of LLM (large language model) and hijacking, is the theft of such keys. Attackers look for keys left in code published on GitHub, in environment variables of breached servers or on development platforms where developers store them. Once they have the key, they can run expensive models in huge volumes on the victim's account.
What do they do with a stolen key? Sometimes they simply sell cheap access to advanced models on a black market, to people who will not or cannot pay themselves. Sometimes they use it to generate content the provider would block on a normal account, such as phishing or scams, because the activity is logged under the victim's name. And sometimes they just exploit expensive compute for any purpose.
The damage can be large and fast. Wiz, which published a report at the end of October on a wave of breaches of AI platforms, described a case in which stolen keys for Amazon's Bedrock service were used for hundreds of thousands of calls. A key without a budget limit can generate an invoice of tens of thousands of dollars or more within days, and sometimes the victim finds out only when the invoice arrives.
Why is it happening now? Because AI keys have become an asset with direct monetary value, and many developers, especially at small startups, still treat them as a technical detail rather than a credit card. Protection starts with a change of mindset: an AI service API key is money and must be guarded accordingly.
