Short answer: Enterprises unknowingly pay $100,000 a day for AI they didn't order, due to stolen access. Tighten security and monitor permissions.
TL;DR
- They resell access through underground services.
- This causes huge bills for victims.
- Monitor and restrict API keys to avoid this.
What happened?
Enterprises unknowingly pay $100,000 a day for AI they didn't order, due to stolen access. Cybercriminals hijack enterprise cloud and model access, then resell it through underground services. To avoid it, monitor and restrict API keys, and tighten security on cloud and model access.
- Credentials / secrets
- Passwords, keys and tokens that prove who you are to a system.
Key facts
| Reported by | CSO Online |
|---|---|
| Date reported | 03 Nov 2026 |
How it works
They then sell this access on the dark web. Companies pay for this fake access, getting huge bills in return. Cybercriminals use special tools to hide their activity, making it hard to spot the fraud.
Timeline
| Date | Event | Source |
|---|---|---|
| 2026-11-03 | Reported by CSO Online | CSO Online |
| 2026-11-06 | This Skillmate explainer published | Skillmate |
How to fix it
- Keep systems and network devices updated and follow vendor security notices.
- Make sure an incident response contact and plan exist before an attack happens.
- Ask your service providers which protections they offer, and test them.
How to detect it
Defenders can look for unexpected cloud charges, unauthorized API requests, and duplicate model access. A false positive could be a legitimate partner using a similar API key.
What is confirmed
- Reported by CSO Online
Why it matters
This matters because companies lose money to fraud. Cybersecurity students must learn to protect credentials and monitor cloud services. Such incidents highlight the need for better access controls and monitoring.
Learn the skills behind this story
Want to understand attacks like this and defend against them? Join Skillmate cybersecurity training or practise hands-on in Skillmate Labs.
FAQ
What are API keys, and why are they important?
API keys are unique codes that allow access to specific services. They are important because they control who can use the service.
How can enterprises prevent LLMjacking attacks?
Enterprises should manage credentials tightly, use least-privilege permissions, and monitor for suspicious low-volume requests.
What should I do if I suspect an LLMjacking attack?
Revoking compromised access and reviewing cloud logs for unusual activity are crucial steps.
Sources
How we wrote this: facts come from the sources above. An on-prem AI model drafted the plain-English parts and every sentence was checked against the sources; unsupported sentences were removed. MITRE mapping is our own judgement.
