LLMjacking: How Leaked Cloud Keys Let Attackers Burn Your AI Budget
LLMjacking is what happens when a leaked cloud credential becomes someone else's free AI budget. On September 3, 2026, Cybersecurity News reported an intrusion — documented by security researchers at FortiGuard Labs — in which a leaked AWS IAM access key with AdministratorAccess let an attacker run paid AI model inference through the victim's own account and bill it to the victim. Can someone steal your AI API access? Yes. The warning signs are quiet, and for many small businesses the first signal is an invoice.
This guide explains what LLMjacking is, how the reported September 2026 attack worked, how to spot theft, and a five-step checklist to protect your LLM API keys.
What is LLMjacking?
LLMjacking is a form of cloud abuse in which attackers hijack a business's paid access to large language models and other AI APIs. Instead of mining cryptocurrency or exfiltrating data with stolen credentials, they run model inference that the legitimate account holder pays for. Stolen access is often resold as bargain AI chatbot subscriptions on Telegram and Discord, researchers report; one tracked campaign, Operation Bizarre Bazaar, has been linked to more than 35,000 attack sessions across more than 30 LLM providers.
LLMjacking vs. cryptomining: attackers monetize your billing relationship
The shift changes how you defend. Cryptomining abuse is loud; LLMjacking is quiet because what is stolen is not compute but the victim's billing relationship with the cloud provider. The calls are legitimate-looking requests to legitimate endpoints; the meter runs against the wrong account.
Not just an API key: the case started with an AWS IAM key
Most “API key theft” talk pictures an application key pasted into a public repository. This case started one level up. The leaked credential was an AWS IAM access key — the identity credential for the entire cloud account — carrying AdministratorAccess, the highest level of privilege an AWS identity can hold. Whoever holds it can create users, change permissions, and sign up for paid AI services in your name.
The September 2026 attack: one leaked AWS administrator key
How it unfolded
Cybersecurity News reported on September 3, 2026, that FortiGuard Labs traced the intrusion to a long-lived AWS IAM access key carrying AdministratorAccess that had leaked. The attacker then:
- Created a brand-new IAM user inside the victim's AWS account.
- Subscribed to foundation models through AWS Marketplace, issuing
CreateAgreementRequestandAcceptAgreementRequestcalls. - Invoked the models directly, generating inference charges billed entirely to the compromised organization.
In several similar cases, attackers also generated Bedrock service-specific API keys for the new identity — a second, less conspicuous inference path.
Why it is so hard to detect
The calls originate from technically valid, permissioned credentials, so at the network and API level the traffic looks identical to legitimate usage. Signature-based defenses do not catch it, because nothing about the traffic itself is inherently malicious. That is why FortiGuard recommends enabling AWS CloudTrail in every account and turning on Bedrock invocation logging — disabled by default — which captures request-level detail that CloudTrail alone misses.
What the report does not say
The report names no victim organization, explains no leak vector, and attaches no dollar figure to the unauthorized usage. Treat the chain as documented and the cost as unknown: dollar figures attached to LLMjacking elsewhere name legacy Claude models and come from earlier research, not this incident.
Can someone steal your AI API access?
Yes — and the theft can happen without the attacker ever seeing your application. A single leaked IAM key with AdministratorAccess is enough to create an identity and subscribe to paid foundation models inside your account. That identity keeps working even after you rotate the leaked key, because it is a separate user; you have to find and delete it.
Signs of AI API key theft rarely look like a classic breach. FortiGuard's guidance: act on corroborating signals, not any single event. Investigate:
- IAM users or access keys you did not create — the strongest signal in this attack chain.
- AWS Marketplace agreements or Bedrock subscriptions you never approved.
- Spend anomalies: inference or API charges climbing without a new workload behind them.
- Unfamiliar IP addresses or regions calling your AI APIs or hitting your AWS account.
- Enumeration behavior or spikes in access-denied errors as the attacker probes what the stolen identity can reach.
One caution from FortiGuard: do not treat first-time Bedrock usage as automatically safe or automatically suspicious. It is actionable only when paired with a corroborating signal, such as a newly created identity or an unfamiliar IP.
How to protect LLM API keys: a 5-step checklist
If you run AI workloads in AWS, or call LLM APIs from code, agents, or vendor integrations, work through this list. AWS IAM AI agent security comes down to which identities can call paid model APIs and how long their credentials live.
1. Rotate long-lived IAM keys now
The entire September 2026 chain hinged on a single non-expiring administrator key. Delete unused IAM access keys, rotate any older than 90 days, and treat any broad-scope key that touched code, logs, or CI as exposed.
2. Apply least privilege — no standing AdministratorAccess
No human or machine identity should hold AdministratorAccess by default. Scope IAM policies to the services and actions a workload actually needs, and review elevated permissions on a schedule. A key that can call only the one model API it needs is worth far less to an attacker.
3. Use short-lived, role-assumed credentials for workloads and AI agents
Prefer IAM roles with temporary credentials over long-lived access keys for anything automated, including AI agents; short-lived credentials expire on their own, so a leak stops being a standing backdoor. Where agents or vendors need access, use an identity layer that issues and revokes credentials centrally.
4. Turn on AWS CloudTrail and Bedrock invocation logging
CloudTrail across every account reconstructs the sequence of identity creation, credential issuance, and marketplace subscription. Bedrock invocation logging, disabled by default, captures request-level detail that shows which models ran and when. You cannot investigate what you did not record.
5. Monitor LLM and API spend anomalies, new identities, and unfamiliar IPs
Alert on inference and API spend, new IAM users and keys, new Marketplace agreements, and calls from unexpected regions. Budget alerts alone are not enough — pair them with identity and access signals so you catch the attacker before the bill spikes.
What to do if you find unauthorized AI usage
- Revoke the leaked credential immediately — rotate or delete the exposed IAM key.
- Audit IAM and delete attacker-created identities. Rotating the leaked key does not remove a user the attacker created; delete it and any keys attached to it.
- Cancel unauthorized subscriptions — Marketplace agreements and Bedrock model access you never approved.
- Turn on CloudTrail and Bedrock invocation logging to reconstruct what happened.
- Keep a record for your provider and insurer. Whether cyber insurance covers AI agents depends on what you can document.
The bigger picture: AI credentials are the new attack surface
LLMjacking is the second act of a story this site has tracked all month. On August 31 we covered AI crawler credential theft: scanners posing as ClaudeBot and GPTBot, with exact user-agent strings, hunting exposed .env files and cloud keys on sites that trust crawler names. LLMjacking is what stolen keys are for — running paid models on someone else's account — so a key harvested by a fake crawler and a key leaked into a repository end in the same place: billed to you.
The fix lives at the identity layer. Our guide to AI agent identity governance covers centrally managed, short-lived identities for AI agents — including the Okta Agent SSO approach that went GA in August — so credentials are issued, scoped, and revoked instead of living in files. The pattern repeats across providers, as our OpenAI Hugging Face AI agent hack analysis showed. For a full sweep, see the AI agent security risks primer and the AI agent risk checklist, which now include IAM and API-key audit items.
Bottom line for small businesses
LLMjacking does not require exotic skills: one leaked administrator key, a few API calls, and the meter runs against your account. You do not need to run frontier AI to be a target. If you have not inventoried your cloud and API credentials this year, do it this week: a short audit plus the five steps above removes the chain the September 2026 case depended on.
Frequently asked questions
Can someone steal my AI API access?
Yes. Any credential that can call a paid AI API is a target: an LLM provider key, a cloud IAM key, or a credential issued to an AI agent. In the September 2026 case, one leaked key let an attacker create a new IAM user and subscribe to paid models inside the victim's account — and that identity kept working after the original key was rotated.
What is LLMjacking?
LLMjacking is a form of cloud abuse in which attackers hijack a business's paid access to large language models and AI APIs. Instead of stealing data or compute, they run model inference the legitimate account holder pays for, then often resell the access as cut-price AI chatbot subscriptions.
How do attackers steal AI API keys?
Keys leak through exposed .env files, code committed to public repositories, logs, phishing, and scanners posing as trusted AI crawlers. Once an attacker holds a broad credential, they can create identities and subscribe to paid models inside the victim's cloud account, as in the September 2026 case.
How do I know if my AI API key was stolen?
Look for corroborating signals: IAM users or keys you did not create, Marketplace agreements or Bedrock subscriptions you never approved, inference spend climbing with no new workload, calls from unfamiliar IPs, and spikes in access-denied errors. None alone proves theft; together they warrant investigation.
What is AWS IAM and why does AdministratorAccess matter?
AWS Identity and Access Management (IAM) controls which identities can do what inside an AWS account. AdministratorAccess is the highest permission AWS offers: an identity holding it can create users, change permissions, and sign up for paid services. In the September 2026 case, one leaked IAM key with AdministratorAccess was enough to do exactly that.
What should I do if I find unauthorized AI usage?
Revoke or rotate the leaked credential immediately, then audit IAM and delete users and keys you did not create — rotation alone does not remove an attacker-created identity. Cancel Marketplace agreements or Bedrock subscriptions you never approved, turn on CloudTrail and Bedrock invocation logging to reconstruct the chain, and keep a record for your cloud provider and cyber insurer.
Source: Guru Baran, Cybersecurity News, “LLMjacking Attack Uses Leaked AWS IAM Key to Steal Paid AI Model Access,” September 3, 2026. The security research described in the report is attributed to FortiGuard Labs.