Short answer: LLMjacking is when criminals steal access to your AI models, usually through a leaked API key or cloud login, and use or resell that access while you pay the bill. Security researchers at Sysdig estimated a single attack could cost a victim more than $46,000 a day. You can prevent most LLMjacking by locking down keys, capping spend and watching usage.
Summary
LLMjacking means hijacking someone else’s AI access. The attacker gets free AI, and the victim gets the invoice.
On 9 November 2026, AI platform Fireworks AI disclosed an LLMjacking attack that exposed customer API keys, billing data and some model weights and datasets.
The same week, AI agent platform Trigger.dev and cloud host Northflank reported breaches, with some customers seeing their AI tokens abused.
The warning signs are a sudden usage spike, unfamiliar models in your logs, and requests at odd hours or from unknown locations.
Most attacks are preventable with secrets management, spending caps, usage alerts and closing exposed AI servers.
In this article
What is LLMjacking?
What happened in the latest LLMjacking attacks?
How does an LLMjacking attack work?
How much can LLMjacking cost?
How do you know if you’ve been LLMjacked?
How do you prevent LLMjacking?
What should you do if you’ve been hit?
Common mistakes that invite LLMjacking
FAQ
What is LLMjacking?
LLMjacking is the theft of access to a large language model (LLM), the type of AI behind tools like ChatGPT and Claude. Attackers steal the credentials a company uses to pay for AI, then run models on that account or sell the access to others. The Sysdig Threat Research Team named the attack in 2024 (The Hacker News, May 2024).
Think of it like someone stealing your company credit card, but for AI. The attacker doesn’t need your data. They want your compute, and you pay for every request they make.
What happened in the latest LLMjacking attacks?
The latest LLMjacking attacks hit AI and cloud platforms that many companies rely on. Here is what was disclosed in early November 2026:
Company | What was disclosed | What was exposed |
|---|---|---|
Fireworks AI (update published 9 November 2026) | An LLMjacking attack, first detected on 6 October, investigated with Palo Alto Networks’ Unit 42 | Account and billing details, API keys and tokens stored as secrets, and some customers’ model weights and datasets. Payment card numbers were not affected. |
Trigger.dev (week of 8 November 2026) | A breach of customer environment variables, the settings where apps store their keys | Customers were told to rotate their keys |
Northflank (week of 8 November 2026) | A breach of customer credentials | Some customers reported their AI and API tokens being abused |
These attacks follow October’s wave of attacks on AI developer tools, many of which also targeted AI API keys. For background, see our guide: Your AI API Keys Are the New Target.
How does an LLMjacking attack work?
An LLMjacking attack works in three steps: steal access, check it, then use or sell it.
Steal the access. Attackers find AI keys or cloud credentials in leaked code, breached platforms, malicious software packages or exposed servers.
Check what the access can do. Attackers test which AI models the stolen key can reach and how much it can spend.
Use it or sell it. Attackers run their own AI workloads, or resell access through illegal “routing gateways” that pass other people’s requests through your account.
A newer version skips stolen keys entirely. Sysdig found attackers using unprotected, self-hosted AI servers as the “brain” of automated hacking tools (Sysdig, June 2026). Independent researchers have catalogued roughly 175,000 publicly exposed Ollama servers, a popular way to run AI models on your own hardware, and Ollama accepts requests without a password by default.
How much can LLMjacking cost?
LLMjacking can cost thousands of dollars a day. Sysdig estimated a single attack could generate more than $46,000 a day in AI usage charges for the victim (The Hacker News, May 2024). The real cost is often higher:
Cost | What it looks like |
|---|---|
Surprise AI bills | Usage charges you didn’t run, often building up overnight |
Data exposure | Stored datasets, prompts or model weights accessed, as in the Fireworks AI attack |
Account suspension | AI providers may suspend accounts that show abuse, taking your product offline |
Investigation and cleanup | Engineering time to rotate keys, review logs and notify customers |
Lost trust | Customers asking whether their data was involved |
Running AI in your product or internal tools? Type B Digital reviews AI setups for exposed keys, open servers and missing controls. Book a 30-minute call and you’ll leave with a prioritized fix list.
How do you know if you’ve been LLMjacked?
You’ll usually spot LLMjacking in your usage dashboard before anywhere else. Check your AI provider and cloud billing pages for these warning signs:
A sudden spike in usage or cost that doesn’t match anything your team launched.
Models you don’t use appearing in your logs.
Requests at unusual hours, such as 3am every night.
Traffic from unfamiliar locations or IP addresses.
New API keys or service accounts that nobody on your team created.
Your provider’s quota limits suddenly being hit.
If you see any of these, treat it as an incident and move straight to the response steps below.
How do you prevent LLMjacking?
You prevent LLMjacking by making your AI access hard to steal and easy to monitor. These steps cover the most common ways in:
Store keys in a secrets manager, never in code, chat messages, shared documents or frontend apps.
Use one key per app and per environment, so you can revoke a single key without taking everything down.
Set hard spending limits and usage alerts with every AI provider and cloud account.
Give each key the minimum access it needs, such as only the models that app actually uses.
Rotate keys regularly, and immediately after any breach at a platform you use, such as Fireworks AI, Trigger.dev or Northflank.
Never expose self-hosted AI servers to the internet. If you run Ollama or similar tools, put them behind a private network and require authentication.
Monitor logs for the warning signs above, and send alerts to a person, not an unread inbox.
Audit third-party tools that hold your keys, including AI agent platforms, hosting providers and coding extensions.
What should you do if you’ve been hit?
If you suspect LLMjacking, act within the hour. Speed limits both the bill and the exposure.
Revoke the affected keys and create new ones. Update your apps with the new keys.
Rotate any other secrets stored in the same place, such as database passwords and third-party tokens.
Check your logs to see when the abuse started, which models were used and whether any data was accessed.
Contact your AI provider. Report the abuse, and ask about blocking the activity and disputing fraudulent charges.
Tell the people who need to know, such as your security lead, leadership and, if data was exposed, affected customers.
Close the gap. Find how the access was stolen and fix it, so the same route doesn’t work twice.
Common mistakes that invite LLMjacking
These are the mistakes we see most often in AI-powered products:
One master key for everything, so a single leak exposes every system.
No spending cap, so the first sign of an attack is the invoice.
Keys in frontend code, where anyone can read them in the browser.
Leaving a test AI server open to the internet “just for now”.
Ignoring vendor breach notices, and not rotating keys when a platform you use is hit.
FAQ
What does LLMjacking mean? LLMjacking means hijacking access to a large language model. Attackers steal the credentials a company uses to pay for AI, then use or resell that access while the victim pays the bill. The Sysdig Threat Research Team named the attack in 2024.
What happened in the Fireworks AI breach? Fireworks AI disclosed on 9 November 2026 that an LLMjacking attack, first detected on 6 October, exposed customer account and billing details, API keys stored as secrets, and some customers’ model weights and datasets. Payment card numbers were not affected.
How much does an LLMjacking attack cost? Sysdig estimated a single LLMjacking attack could cost a victim more than $46,000 a day in AI usage charges. The total depends on which models the stolen access reaches and how long the abuse goes unnoticed.
How do I protect my OpenAI or Anthropic API key? Store the key in a secrets manager, never in code or chats. Use separate keys per app, set spending limits and usage alerts, give each key minimal access and rotate keys regularly.
Can self-hosted AI models be LLMjacked? Yes. Self-hosted AI servers exposed to the internet without authentication can be used by attackers for free. Researchers have catalogued roughly 175,000 publicly exposed Ollama servers. Keep self-hosted models on a private network.
What should I do if my AI bill suddenly spikes? Treat a sudden AI bill spike as a possible attack. Revoke and replace the affected keys, check logs for unfamiliar models and locations, contact your AI provider and find how the access was stolen.
Protect your AI before someone else uses it
LLMjacking isn’t a reason to avoid AI. It’s a reason to treat AI access like any other valuable account: locked down, monitored and capped.
Type B Digital is a technology consultancy that builds and secures AI-powered products, from AI security reviews to managed IT and cyber security support. Book a 30-minute call. You’ll leave with a clear picture of your AI security gaps and a prioritized list of fixes.
Sources
GBHackers: Fireworks AI hit by LLMjacking cyberattack exposing customer data and AI model weights (10 November 2026)
RIO Rundown: AI News, 10 November 2026 (10 November 2026)
This Week in Security: 8 November 2026 edition (Trigger.dev and Northflank breaches)
The Hacker News: Researchers uncover “LLMjacking” scheme targeting cloud-hosted AI models (10 May 2024)
Sysdig: LLMjacking evolved: attackers are using stolen AI compute to build offensive agentic tools (17 June 2026)
