As demand for AI grows, hacking focused on stealing computing power is spreading, differing from attacks that target personal data or extort money with ransomware.

A recent Wall Street Journal (WSJ) report said that over the past month more than 10 AI development platforms, including Railway, came under cyberattacks. In many cases, hackers targeted application programming interface (API) information, an online credential.

The stolen keys are being misused to gain unauthorized access to U.S. AI models. In the Railway hack, attackers stole cryptocurrency worth $371,000 along with Railway customers' API keys. That led to at least $750,000 in usage fees on AI services including Amazon Bedrock, OpenAI, Anthropic and Google Gemini, the WSJ reported, citing the company.

Cybersecurity firm R10N Security, which analyzed AI session records conducted using account credentials stolen from Railway customers, said leaked keys were used for various tasks including 3D video game creation and research related to real estate development.

AI infrastructure company Zeabur also suffered a hack in which API keys were stolen, leading to $100,000 in charges.

Google Threat Intelligence Group (GTIG) and Google's Mandiant said the method of stealing access rights to corporate AI models and using them for malicious activity or reselling them to other attackers is summed up as “LLMjacking”.

Unlike cryptojacking, which gradually siphons other people's computing resources, LLMjacking differs in that it can generate large usage fees in a short period. In some cases, fraudulent usage fees exceeded $100,000 in a single day. At some companies, cumulative damage reached $1 million before unauthorized access was blocked.

Hackers are evolving toward directly targeting large companies to steal API keys.

Recent attacks targeted financial services, retail, technology and transportation companies in North America, South America and the Asia-Pacific region. Attackers infiltrated target environments through credential theft and session hijacking. Session hijacking is a method of intercepting a logged-in session to access a system. Attackers also collected credentials exposed in public GitHub repositories.

One attacker made more than 500,000 LLM API calls in under 8 hours. The attacker also used a tactic of repeatedly creating and deleting short-lived service accounts to avoid call limits.

Attackers are pooling multiple stolen API keys at a single illicit relay server and profiting by selling model access cheaply on cybercrime underground markets. Buyers use AI models through the relay server instead of purchasing API keys individually, Google analysis showed.

One illicit token routing service offered buyers unlimited access to frontier models for about $60 a month, and the victim company was billed $1 million in model usage costs.

These broker sites also sell access to U.S. AI models to users in countries where use of U.S. AI models is restricted, including China, Russia and Iran. Anthropic also said recently these broker sites are often used to replicate U.S. AI models using distillation technology. Distillation is a method of training a smaller model using a dataset generated by large models from frontier AI companies such as Anthropic and OpenAI.

Matthew Lenhard (매튜 렌하드), founder of token abuse prevention service Vectoral, was quoted as saying, “Tens of millions of people visit these sites every month,” adding, “Some people are making a lot of money from this business.”

Chainalysis analyst Kumi Mita (쿠미 미타) said, “Broker services that make it possible to use U.S. frontier AI models cheaply have become one pillar of China’s economy,” adding, “We have identified more than 700 such services online.” Chainalysis analysis also found the top 5 broker sites together took in $6 million in cryptocurrency revenue.

Hacking attacks pouring into cloud-based AI development platforms to target access rights to AI models began in early October, and are still seen as showing no signs of abating. It is unclear at this point whether it will remain a temporary disturbance or continue.

Against this backdrop, Dax Raad (닥스 라드), co-founder of AI software development platform OpenCode, was quoted as saying, “These attacks will not stop,” adding, “The only reason we are holding on is that AI agents are responding 24 hours a day without rest. Team members are also ‘barely sleeping.’”

Measures to respond to LLMjacking include threat hunting, identifying unauthorized LLM use within an organization, fine-grained API key permissions and automated secret scanning. John Hultquist (존 헐트퀴스트), GTIG's chief analyst, said, “Attackers use agentic tools to scale attacks by stealing tokens without victims noticing,” adding, “Companies must strictly control access to LLM resources to prevent a cost bomb. They should review resource usage, enable multi-factor authentication (MFA) and carefully manage account information.”