Unverified50% confidenceFactExact time
LLMjacking refers to attackers stealing others' cloud account or AI service credentials and calling large language model APIs under the victim's identity and quota; it usually works together with Infostealers: first stealing API keys for cloud services or AI platforms, then using them to call models.
1
Sources
50%
Confidence
Long-term
Relevance
10/17/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedAttackers can exploit stolen AI service account credentials to call API interfaces for computing power theft, and such behavior has frequently appeared in terms-of-service violation reports on platforms such as OpenAI and Anthropic.69% similarUnverifiedLeaked LLM API keys can be monetized directly, as attackers resell access or run their own workloads on the victim's bill, so the value of a single `.env` file has risen and the amount of hunting has increased accordingly.67% similarUnverifiedCredential stuffing attacks refer to attackers automatically attempting to use username-password combinations leaked from one breach to log in to other websites in order to take over accounts.66% similarUnverified攻击者利用AI幻觉出的包名，提前在npm、PyPI等包注册表抢注并植入恶意代码，这种攻击手法被称为slopsquatting65% similarUnverifiedGateway-layer desensitization refers to a separate proxy layer completing the identification and replacement of sensitive information before the request reaches the LLM API.65% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1050770API
curl https://kongchang.com/api/v1/knowledge/claims/1050770MCP
get_claim(id=1050770)