# LLMjacking: when someone else's cloud account pays the AI bill

Security researchers documented stolen credentials and a proxy mechanism. Low pricing alone does not establish that a reseller uses it.

[Canonical HTML page](https://nosecrets.app/en/stories/llmjacking-cheap-ai-stolen-credentials)

Published by: [No Secrets Research](https://nosecrets.app/en/about#methodology)
Added: 2026-10-20
Topic: Technology

## Scope and context

Applies to: 2024 cloud-security research · AI access supply chains
Time context: Sysdig research published May 6, 2024; historical case
Sources checked: 2026-10-20

The cited research describes an observed attack and inferred resale motivation. It does not establish how common this is or identify every proxy as malicious.

## What researchers actually observed

Sysdig reported attackers using stolen cloud credentials to probe hosted LLM access. It observed signs of reverse-proxy use and described how access could be monetized while the compromised account owner bears the cost. This is security research, not No Secrets' own investigation.

[1: Sysdig Threat Research Team](https://www.sysdig.com/blog/llmjacking-stolen-cloud-credentials-used-in-new-ai-attack)

## What a buyer can reasonably infer

Our inference: a supply chain dependent on unauthorized credentials can disappear when access is revoked. Request a contractual seller identity, an explanation of authorized upstream access and a refund policy. A successful demo proves availability at that moment, not lawful provenance.

[1: Sysdig Threat Research Team](https://www.sysdig.com/blog/llmjacking-stolen-cloud-credentials-used-in-new-ai-attack)

## If you own the cloud account

AWS recommends temporary credentials where possible, least-privilege permissions, and regular removal of unused credentials. Apply those controls to AI integrations too; treat an unexpected bill as a reason to inspect access and usage rather than assuming your own workload caused it.

[2: AWS](https://aws.amazon.com/iam/resources/best-practices/)

## Sources

1. [LLMjacking: Stolen Cloud Credentials Used in New AI Attack](https://www.sysdig.com/blog/llmjacking-stolen-cloud-credentials-used-in-new-ai-attack) — Sysdig Threat Research Team. 2024-05-06. Original security research; observed compromise and possible resale mechanism, not a census of proxy services.

2. [AWS Identity and Access Management best practices](https://aws.amazon.com/iam/resources/best-practices/) — AWS. . Temporary credentials, least privilege and unused-key removal.

## Disclosure

AI-assisted research, writing and translation by No Secrets, using the linked public documents. This is a source summary, not firsthand reporting or an independently audited investigation. No affiliate links are used in this article.

The source-check date is not the event date. Original documents control if a summary differs.