LLMjacking 2024 to 2026: How Stolen Cloud Credentials and API Keys Became Free AI for Attackers

LLMjacking is the theft of access to cloud-hosted large language models using someone else's credentials. Sysdig named it in May 2024, after watching attackers use cloud credentials stolen from a vulnerable server to reach models on AWS Bedrock and other AI services. Since then, researchers and Microsoft have documented the same pattern at growing scale: stolen access keys and API keys checked for model access, pooled behind reverse proxies and resold, while the victim pays the inference bill. This page tracks the documented cases as a single campaign. For a detailed look at one October 2024 case, see our earlier page on the AI LLM hijack breach.

At a glance

What happened

On 6 May 2024, Sysdig published research on an attack that "leveraged stolen cloud credentials in order to target ten cloud-hosted large language model (LLM) services". The attackers had exploited a Laravel system vulnerable to CVE-2021-3129, taken cloud credentials from it, and then checked which AI services those credentials could reach. Sysdig listed ten targeted services, including AI21 Labs, Anthropic, AWS Bedrock, Azure, ElevenLabs, MakerSuite, Mistral, OpenAI, OpenRouter and GCP Vertex AI. It said the attackers appeared to be selling the access, with victims bearing the cost, and estimated that maximising quota use with Claude 2.x models across regions could cost a victim "over $46,000 of LLM consumption costs per day".

The attackers were careful. To check whether a stolen key could invoke a model without triggering an obvious error, they sent InvokeModel requests with an invalid parameter, and they called GetModelInvocationLoggingConfiguration to see whether prompts were being logged. Access was then shared through OAI Reverse Proxy, an open source tool that pools many LLM accounts behind a single endpoint and hides the underlying credentials from the people using it.

On 18 September 2024, Sysdig reported that the activity had grown. It had seen more than 85,000 Bedrock API requests over several months, including 61,000 in a three-hour spike on 11 July 2024, and a tenfold increase in LLM requests during July. Attackers adopted AWS's new Converse API within 30 days of its release. Sysdig said motives included evading sanctions that block Russian users from Western AI services, adult role-play, which made up about 95% of observed prompts, and image analysis. Using Claude 3 Opus, it estimated, could cost a victim "over $100,000/day".

Permiso published its own findings on 3 October 2024. On 25 June 2024 it deliberately exposed an AWS access key on GitHub, with invocation logging turned on. "Within minutes actors were attempting to leverage the exposed key," it said. Over two days, attackers made about 75,000 successful model invocations, almost all for a sexual role-play chat service, using jailbreak techniques to bypass content filters. Permiso reported that a small percentage of the content included child sexual exploitation material. The attackers asked for Bedrock model access with PutUseCaseForModelAccess and CreateFoundationModelAgreement before invoking models, and used reverse proxies such as oai-reverse-proxy and one-api. Permiso noted that "compromised credentials of the human and non-human variety continue to be the most common method for initial access into cloud environments."

On 27 February 2025, Microsoft's Digital Crimes Unit named four people it alleged were part of Storm-2139, a network that "exploited exposed customer credentials scraped from public sources to unlawfully access accounts" with generative AI services. Microsoft said the group "altered the capabilities of these services and resold access to other malicious actors". The abuse included non-consensual intimate images of celebrities, whom Microsoft chose not to name. The named individuals were in Iran, the United Kingdom, Hong Kong and Vietnam. Microsoft had filed its lawsuit in the Eastern District of Virginia in December 2024 and seized a website central to the operation; our earlier page on the Azure OpenAI Service abuse by a hacking-as-a-service group covers that first stage of the case. Dark Reading described the case as LLMjacking, reporting that "Storm-2139 found exposed API keys and was able to hijack the GenAI services."

The market has kept evolving. Sysdig reported that attackers added DeepSeek-V3 to their target lists "within days of its release" and described LLMjacking as having "become commercialized". In January 2026, Pillar Security documented Operation Bizarre Bazaar, which resold AI access through a marketplace called silver.inc. That campaign differs in one important way: it targeted self-hosted and unauthenticated AI endpoints, such as exposed Ollama servers and OpenAI-compatible APIs, rather than stolen keys. It recorded more than 35,000 attack sessions against Pillar's honeypots over 40 days, according to BleepingComputer.

Timeline

How it happened: the identity attack path

1. Credential theft or discovery. Attackers take cloud credentials from compromised servers, as with the Laravel flaw in Sysdig's case, or collect access keys and API keys exposed in public code and other public sources.
2. Quiet validation. Each key is tested for model access with requests designed not to raise obvious errors, and logging settings are checked to see whether prompts are recorded.
3. Enabling models. Where the victim has never used a model, attackers request access to it through the provider's model access APIs, using the victim's identity.
4. Pooling behind a proxy. Working keys are loaded into reverse proxies that spread traffic across many victims and hide the credentials from buyers.
5. Resale and abuse. Access is sold or shared, and used for content the providers prohibit. The victim organisation receives the bill.

Impact

• Cost: potential inference charges estimated by Sysdig at over $46,000 per day with Claude 2.x and over $100,000 per day with Claude 3 Opus.
• Volume: more than 85,000 Bedrock requests observed by Sysdig, and about 75,000 successful invocations in two days on Permiso's single bait key.
• Harmful content: hijacked access used for sexual content, non-consensual celebrity images and, in Permiso's data, a small share of child sexual exploitation material, all generated under the victims' accounts.
• Legal: Microsoft's civil action against Storm-2139 and the naming of four alleged members.

What this means for NHI governance

LLMjacking is a non-human identity problem with an AI price tag. The attacker never needs to break the AI platform. They need one valid access key or API key with permission to call a model, and the platform treats their requests as the victim's own. Because AI inference is expensive and model access is often granted broadly inside cloud accounts, a key that was created for storage or a test project can quietly become a key that runs up large inference bills for someone else's workload.

The documented cases share three governance gaps. Keys were long-lived and usable from anywhere, so a key leaked on GitHub worked within minutes. Permissions were broad enough that a general cloud credential could enable and invoke foundation models it had never used. And monitoring missed new model access requests, invocation spikes and disabled logging. The Bizarre Bazaar campaign shows the same problem from the other side: an AI endpoint with no authentication at all is an identity control that was never put in place.

Other cases on our timeline, such as the JetBrains Marketplace plugins that stole AI API keys, show attackers actively hunting AI credentials too.

Recommendations

• Remove static cloud keys where possible. Use roles and workload identity federation instead of long-lived access keys. Our Cloud Workload Identity Guide explains the options.
• Restrict who can enable and invoke models. Deny model access and invocation permissions by default, and grant them only to the identities and accounts that need them.
• Scan for exposed keys and rotate at once. Monitor public repositories and internal code for cloud and AI API keys. See the Secret Sprawl Challenge.
• Keep invocation logging on and alert on changes. Treat calls that query or disable model logging, and first-time model access requests, as high-priority alerts.
• Set spending limits and anomaly alerts. Budget alarms on AI services catch LLMjacking faster than most security tools.
• Authenticate every AI endpoint. Self-hosted model servers and AI APIs should never be reachable without authentication, as covered in our NHI Authentication Guide.

Frequently asked questions

What is LLMjacking?

LLMjacking is the use of stolen cloud credentials or API keys to access hosted large language models at the victim's expense. Sysdig coined the term in May 2024.

How do attackers get the credentials used in LLMjacking?

Documented cases include cloud credentials stolen from vulnerable servers, such as a Laravel system affected by CVE-2021-3129, and access keys or API keys exposed in public sources such as GitHub.

How is this different from the AI LLM hijack breach page?

That page covers the single case Permiso documented in October 2024. This page covers LLMjacking as a campaign, bringing together the Sysdig, Permiso and Microsoft cases and later developments.

Related NHI Mgmt Group resources

AI LLM hijack breach · Azure OpenAI Service abuse · Secrets in a public LLM training dataset · Static vs Dynamic Secrets · NHI breaches

How NHI Mgmt Group can help

Securing Non-Human Identities (NHIs), including AI agents, is becoming increasingly crucial as attackers target cloud access keys, AI service API keys, tokens and secrets. Our NHI Foundation Level Training Course gives teams the practical grounding to find, govern and protect these identities.

References

• Sysdig: LLMjacking, Stolen Cloud Credentials Used in New AI Attack (6 May 2024)
• Sysdig: The Growing Dangers of LLMjacking, Evolving Tactics and Evading Sanctions (18 September 2024)
• Permiso: When AI Gets Hijacked, Exploiting Hosted Models for Dark Roleplaying (3 October 2024)
• Microsoft: Disrupting a global cybercrime network abusing generative AI (27 February 2025)
• Dark Reading: Microsoft Busts Hackers Selling Illegal Azure AI Access (28 February 2025)
• Sysdig: LLMjacking, From Emerging Threat to Black Market Reality (24 February 2026)
• BleepingComputer: Hackers hijack exposed LLM endpoints in Bizarre Bazaar operation (28 January 2026)