LLMjacking: Stolen Cloud Keys Are Running Up Six-Figure AI Bills
❓What:
Since late October 2026, Arctic Wolf has seen more attackers use stolen cloud credentials to run generative AI workloads at the victim’s expense. This is called LLMjacking.
Stolen credentials have included AWS IAM access keys, Lambda execution role sessions, and Entra ID service principal secrets.
Targets include Amazon Bedrock, Azure OpenAI, Azure AI Foundry, and Google Cloud AI services.
Attackers check which models and limits they can reach. Then they run premium models at high volume or resell the access through underground “mixer” proxy services.
Wiz documented incident disclosures from several AI developer platforms in October. Some of those incidents involved exposed credentials stored in environment variables.
No single threat actor or vulnerability has been tied to the activity.
⚠️Impact:
Public reporting shows single incidents passing $100,000 in charges in one day. Some organizations approached $1 million before access was cut off.
The abuse looks like normal API usage, so it can go unnoticed until the bill arrives.
Bedrock model invocation logging is off by default. Without it, you can’t tell what the stolen access was used for.
Credentials kept in CI/CD pipelines, containers, and dev platforms widen your exposure, even if your own cloud tenant was never breached.
💡Recommendations:
Replace long-lived access keys with short-lived, role-based credentials.
Rotate cloud credentials that can reach AI services. Start with keys older than 90 days and keys with no clear owner.
Remove dormant IAM users and unused service principals.
Limit AI model access to approved models and regions using least privilege, AWS SCPs, or Azure Policy.
Turn on Bedrock invocation logging in every region, plus Azure AI diagnostic logging.
Set usage limits and spend alerts on AI services.
Audit CI/CD secrets and environment variables for exposed cloud keys.
If you use an affected AI dev platform (Northflank, Fireworks AI, Lightning AI, Railway, and others), review that platform’s advisory.