LLMjacking: Running Up Victims' AI Bills with Stolen Keys
On this page
The attackers didn't want your data — they wanted your inference budget, and someone else to pay for it.
| When | May 2024 |
|---|---|
| Target | Cloud-hosted LLM inference (Bedrock, Azure OpenAI, etc.) |
| Researcher | Sysdig Threat Research (named the class) |
| Technique | Stolen cloud creds → LLM inference abuse / resale |
| Impact | Est. $46K/day worst case for one victim (Sysdig estimate) |
- 1Attackers steal cloud credentials from a vulnerable app
- 2They validate the keys against ten hosted LLM providers
- 3They run — and resell — expensive inference billed entirely to the victim
What happened
In 2024, Sysdig observed attackers who obtained cloud credentials (via a vulnerable app) and used a script to test them against ten hosted LLM services. Rather than steal data, they abused the victims' access to run LLM inference at the victims' expense — and resold access through reverse-proxy tooling. Sysdig estimated worst-case costs over $46,000 per day for a single victim, and coined “LLMjacking.”
How it worked
This is a “denial of wallet” attack: the harm is the bill. Stolen credentials plus expensive, unmetered inference equals a resellable resource paid for by someone else.
Root cause
Credential compromise combined with no consumption guardrails on the LLM APIs — no spend caps, quotas, or anomaly alerts to catch the abuse.
What a control would have caught
Spend/quota alerting and anomaly detection on inference usage flags a sudden 10x request spike quickly; least-privilege keys limit which providers a leaked credential can even reach.
How to prevent it
- Rotate and scope credentials; assume they leak.
- Set spend caps and quotas, with alerts on anomalies.
- Monitor inference usage the way you'd monitor a cloud bill.
FAQ
What is “denial of wallet”?
An availability/cost attack: instead of taking a service down, attackers make you pay — here by consuming (and reselling) expensive LLM inference on your cloud account.
How did they get in?
By stealing cloud credentials (in the first case, via a vulnerable Laravel app), then validating them against ten hosted LLM providers and abusing whichever worked.
Is the $46K/day figure confirmed?
It's Sysdig's worst-case estimate for a single victim, not a confirmed bill — but the technique and its rapid growth (≈10x request volume within months) are well documented.