LLMjacking turns exposed NHI secrets into rapid AI abuse

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Entro Security's blog post: Leaked AWS non-human identities can be discovered within minutes and quickly turned into model enumeration and attempted AI misuse.

Why it matters: IAM, cloud, and NHI teams need to treat exposed secrets as an active AI abuse path because access can be probed and monetised before manual response starts.

Context

LLMjacking is the abuse of generative AI services through stolen non-human identity credentials such as API keys and tokens. In this pattern, the governance failure is not limited to cloud misconfiguration. It is that exposed machine credentials can grant direct access to expensive AI services before teams even know the secret has leaked, making NHI exposure an operational AI risk.

Entro Security’s research recreated that path by leaking valid AWS credentials across public channels and observing what happened next. The article’s core point is that attackers do not need a long dwell time to begin abuse. Once a key is public, reconnaissance, model enumeration, and attempted invocation can follow almost immediately.

For IAM and security architects, the important shift is that AI service access must be governed as part of the NHI lifecycle, not as a separate GenAI concern. The article treats exposed AWS keys as the entry point to both cloud abuse and AI misuse, which makes secret hygiene, privilege scope, and rapid revocation the key controls in play.

Key questions

Q: What breaks when an exposed NHI can reach GenAI services?

A: The control that breaks is the assumption that a leaked credential only creates cloud risk. Once the same secret can enumerate or invoke AI models, the exposure becomes an abuse path for cost burn, content generation, and possible data loss through legitimate APIs.

Q: Why do leaked AWS access keys create immediate account risk even before an attacker uses them?

A: Leaked AWS access keys can be analyzed for account metadata and then tested quickly, which means exposure creates risk before any obvious misuse appears. The danger is not just credential theft, but what the key can reach and how fast an attacker can act. Organisations should assume exposed keys are actionable intelligence and move quickly on validation, rotation, and access review.

Q: How do teams decide whether to prioritise secrets rotation or access visibility first?

A: Teams should prioritise visibility first when they do not know where secrets live, who owns them, or which integrations use them. Rotation helps only after discovery and control are in place. If access paths remain opaque, a rotated secret can be replaced by another unmanaged one. Visibility establishes the inventory that makes rotation, monitoring, and revocation effective.

Q: What are the signs that LLMjacking is already underway?

A: Look for service enumeration, model listing, unusual billing checks, and rapid follow-on invocation attempts from the same NHI. Those signals indicate that an attacker has moved beyond discovery and is testing whether the credential can be monetised.

Technical breakdown

How exposed AWS keys become GenAI entry points

The attack starts when a valid machine credential is exposed in a public channel such as code repositories, paste sites, or collaboration tools. Because the credential is already authenticated, attackers do not need to bypass login controls. They can call cloud APIs directly, often through SDKs or scripted clients, and the cloud platform will accept the request as legitimate. In this case, the exposed AWS key became the entry point to enumerate account value, inspect available services, and probe whether AI model endpoints were reachable. The important technical detail is that identity abuse begins with valid authorisation, not with malware or password theft.

Practical implication: expose-detection and immediate revocation matter more than post-factum investigation once a key is public.

Why model enumeration comes before model abuse

Attackers typically test the credential before trying expensive or noisy AI actions. The article shows reconnaissance calls such as checking account value and listing available foundation models, which lets the attacker decide whether the key is worth further use and what models can be reached. This is a classic abuse sequence: validate access, map entitlements, then attempt the highest-value action. In GenAI environments, enumeration is not harmless curiosity. It is the step that tells the attacker whether the credential can reach a monetisable model endpoint and whether the victim will pay for the abuse.

Practical implication: alert on model-discovery API calls as early abuse indicators, not just on successful prompt execution.

Why unauthorized InvokeModel calls are an identity problem

Once the attacker confirms access, the final stage is the unauthorized model invocation itself. That call is not merely an application misuse event. It is an identity and privilege event because the attacker is exercising the victim’s own authorised path to the AI service. The credential’s permissions determine whether the attacker can only enumerate models or can actually run them at scale. In this sense, LLMjacking is a governance failure in entitlement design, secret containment, and account-level blast radius. The abuse cost, content generation, and any downstream data exposure all flow from that original entitlement scope.

Practical implication: treat AI invocation permissions as high-risk entitlements and keep them tightly bounded to the minimum required services.

Threat narrative

Attacker objective: The attacker wants to validate stolen cloud access, discover which AI models can be reached, and use the victim’s entitlement to generate content or incur charges.

1. Entry occurred when a valid AWS secret was exposed in public locations and later picked up by automated scanning or a human operator.
2. Credential access followed immediately because the attacker used the valid key, not a guessed password, to issue authenticated API calls.
3. Escalation took the form of service enumeration and model discovery, including checks for account value and available LLMs.
4. Impact began when attackers attempted unauthorized GenAI invocations, turning the victim’s cloud entitlement into a platform for AI abuse and potential cost burn.

Breaches seen in the wild

• TruffleNet stolen AWS keys campaign 2025: TruffleNet used 800+ attacker hosts to test stolen AWS keys and check SES capacity; one compromised account sent a fake $50,000 invoice.
• Microsoft Azure OpenAI abuse by Storm-2139: Storm-2139 used API keys leaked by Microsoft customers to hijack Azure OpenAI, bypass safety guardrails and resell access to generate harmful content.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Ephemeral secret exposure is the real LLMjacking control failure: the attack works because a valid NHI credential is discoverable before it is revoked. The article’s minute-level time-to-first-use shows that exposure windows are now measured against automation, not human response cycles. That means the decisive control is not just strong authentication. It is how quickly a leaked machine credential can be found, scoped, and removed.

LLMjacking is NHI governance with AI consequences, not an AI-only problem: the exposed secret is the governance object, and the AI model is the abuse target. That distinction matters because many teams still separate cloud secrets, identity lifecycle, and GenAI oversight into different programmes. The article shows those controls fail together when the same credential unlocks both infrastructure and model access. Practitioners should treat AI endpoint permissions as part of machine identity governance.

Model discovery is the new pre-attack validation step: attackers do not need to invoke a model first to prove abuse potential. Enumerating accessible models, spending limits, and service reach gives them enough intelligence to decide whether to proceed. That changes the defensive target from only blocking generated output to detecting the identity signals that precede it. Security teams should view discovery calls as part of the abuse chain, not as harmless reconnaissance.

Standing AI entitlements create identity blast radius: the article shows that once a leaked credential can reach GenAI services, the damage can include cost burn, content abuse, and possible data exposure through the victim’s own account. This is a governance issue because the blast radius is defined by entitlement scope, not by the attacker’s sophistication. The more broadly an NHI can reach model endpoints, the more quickly a single leak becomes a multi-dimensional incident.

Human users are not the only accountability problem in AI abuse: when a machine credential is the actor, the organisation must know which workload, team, or pipeline owns the entitlement and who can revoke it instantly. That is a lifecycle problem, not merely a SOC detection problem. The implication is that AI access reviews should focus on the actual secret, its issuing system, and its current service reach, not on abstract ownership labels.

From our research library:

• NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
• Generative AI use specifically increased from 33% in 2023 to 79% in 2025, according to McKinsey’s Global Surveys on the State of AI.
• Read next: Ultimate Guide to NHIs

What this signals

Entitlements, not just secrets, now define the AI abuse surface: when a leaked credential can reach model endpoints, the organisation has already lost the first control boundary. That means NHI inventory and entitlement review have to include every workload that can touch GenAI services, not just the ones labelled as production identities.

Minute-level abuse windows collapse traditional review cycles: attackers in the article moved from exposure to first access attempts in 17 minutes on average. Access reviews cannot compensate for a control failure that happens faster than the review process itself, so the programme has to shift toward detection and revocation at issuance time.

LLMjacking is a named concept for the intersection of secret leakage and model abuse: it describes the moment a leaked NHI credential becomes a direct path into AI services. That concept matters because it links cloud secret hygiene, AI governance, and identity blast radius into one operational problem.

For practitioners

• Inventory AI-reachable NHIs Map every AWS key, token, and service account that can reach GenAI services, model endpoints, or billing-sensitive APIs. Separate general cloud credentials from those that can invoke or enumerate models so the highest-risk secrets are obvious to responders.
• Detect public-secret exposure in minutes, not days Continuously scan repositories, paste sites, collaboration tools, and logs for secrets that match cloud credentials. The article shows attackers can begin probing within 17 minutes on average, so detection has to happen before manual review cycles catch up.
• Revoke and rotate leaked keys automatically Trigger immediate revocation when a secret is confirmed exposed, then rotate any downstream credentials that inherit the same trust path. For AI-capable keys, revocation should be the default first response because model enumeration can start before analysts finish triage.
• Constrain AI model entitlements tightly Limit NHI permissions to the smallest set of model actions and services required for the workload. Do not leave broad InvokeModel or discovery rights on credentials that do not need them, especially where billing or content abuse would be costly.
• Alert on model enumeration as an abuse precursor Treat service discovery, model listing, and unusual billing-related API calls as early signs of LLMjacking. These calls often appear before actual prompt execution, so they belong in detection logic alongside known secret-leak indicators.

Key takeaways

• Leaked machine credentials can be weaponised almost immediately when they carry access to AI services, so exposure management is now an identity and AI governance problem at once.
• The article’s evidence shows that attackers do not jump straight to model abuse. They first validate the credential, enumerate reachable services, and only then attempt invocation.
• Fast revocation, tight AI entitlements, and continuous secret scanning are the controls that limit the damage once an NHI secret leaves its intended boundary.

Key terms

• LLMjacking: Abuse of cloud AI services through stolen machine credentials rather than human user accounts. The attacker uses valid non-human identities such as API keys or tokens to enumerate model access, invoke endpoints, and create cost, data, or policy exposure under the victim's tenancy.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• Model Enumeration: The process of discovering which AI models, endpoints, or permissions are available to a credential before attempting higher-impact abuse. It is a reconnaissance step that helps attackers gauge account value, avoid detection, and decide whether to proceed with unauthorized model invocation.
• Secret exposure window: A secret exposure window is the period between when a credential becomes visible to an attacker and when it is detected, revoked, or rotated. In CI/CD environments that window can be extremely short, which is why detection speed and identity-linked revocation matter as much as storage hygiene.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.