LLMjacking Turns Stolen Enterprise AI Access Into a Costly Proxy Business
Stolen access to enterprise AI models is becoming a subscription business, and the victim’s cloud account pays the tab. Google Threat Intelligence Group (GTIG) says criminal operators are pooling compromised credentials and reselling model access through underground routing services. In some incidents, charges topped $100,000 in a day; cumulative costs reached $1 million before organizations shut off access.
GTIG based its findings on multiple incidents in 2026 involving cloud and large language model providers across North America, South America, and Asia Pacific. The activity shows how a compromised key can serve two purposes: opening a path into an organization’s environment and generating revenue for whoever controls it.
Proxy services turn stolen keys into subscriptions
GTIG calls the criminal routing gateways “LLM Mixers.” They collect compromised API credentials, route customer requests across multiple accounts, and obscure which organization is supplying the underlying model access. Some operators rely on open-source gateways; others build their own relay systems.
One threat actor, UNC6993, used tools including new-api and gcli2api to combine stolen keys and spread requests across accounts. In a separate operation, stolen third-party API keys powered Jet Night, a legitimate token-routing service. GTIG said it processed more than 500,000 LLM API calls in under eight hours, passing nearly $1 million in token costs to the victim.
Jet Night advertises unlimited access to frontier models for about $60 a month, far below the typical cost of comparable legitimate access. GTIG suspects some of the service’s outages followed victims’ discovery of the compromises and revocation of the keys.
“LLM Mixers turn stolen enterprise model access into a service for paying customers, while the victim’s systems continue accepting requests through credentials they recognize,” said Piyush Sharma, co-founder and CEO at Tuskira. His concern is the authority attached to each credential: a key meant for one application shouldn’t grant reusable access to other models and workloads.
Low-volume checks can precede a spending spike
The theft often starts with exposed or stolen cloud identity tokens, including IAM credentials, service account keys, GitHub personal access tokens, and active session tokens. Attackers also search public repositories for LLM API keys and scan for exposed model endpoints.
Before putting a stolen key to work, attackers may test it with a request capped at a single token. These tiny transactions can confirm that a credential is active while staying below common consumption-based alerts. “Testing a stolen key with a single-token request barely registers as consumption,” said Nick Tausek, lead security automation architect at Swimlane. He said an unexpected permission change or newly created credential alongside that request can make the activity more revealing.
Once inside, attackers may search cloud services, code repositories, and data stores for more credentials. GTIG has observed privilege escalation, unauthorized service accounts, injected SSH keys, and persistence through compromised workloads. In one follow-on attack, an actor exploited a user ID rebinding vulnerability in the LiteLLM gateway to turn ordinary virtual keys into administrative credentials.
“Selling stolen model access gives criminals a reason to keep that access working for as long as possible, which makes the quiet activity before the spending spike especially important,” Tausek said. By the time an unexpected bill draws attention, he added, the attacker may already have paying customers.
GTIG recommends limiting credentials to their intended models, workloads, and endpoints; applying least-privilege permissions and granular API key scopes; and setting model spending limits. Monitoring should also cover low-volume suspicious requests, unauthorized AI service enablement, and gateway vulnerabilities. The practical takeaway is to treat AI credentials and routing layers as part of the same access-control system: a small test request can be the first sign that someone else has started using them.
