UK — The Register
Token thieves costing companies $100K+ per day in illicit LLM charges
Security1 min read
Criminals are stealing access keys to companies' AI tools and running up huge bills. Google says some victims lost more than $100,000 a day, and one lost $1 million in total.
What happened
Hackers are taking over companies' access to large language models (LLMs). An LLM is the kind of AI that powers chatbots. Hackers use the company's account to run AI tools and computing power for themselves. The company then gets the bill. Google's Mandiant team, which helps companies after cyberattacks, reported this on Monday. The tactic is called LLMJacking.
Key numbers and facts
- Some fake charges went above $100,000 a day.
- At some companies, total charges reached $1 million before the hackers were blocked.
- In one August case from CrowdStrike, a thief sent about 200,000 API requests in two minutes.
- One intruder made more than 500,000 LLM API calls in under eight hours, using stolen third-party keys for a service called Jet Night.
- Jet Night offered an unlimited plan for about $60 a month. Similar plans usually cost $100 to $250 a month.
How the thieves work
An API key is a secret code that lets a program use a service. Thieves steal these keys or find weak settings in cloud accounts. One group, UNC6993, made new keys and turned on services inside the victim's cloud project. Another thief used short-lived accounts to avoid usage limits. Some criminals now split the work. One group gets in. Another group, called LLM Mixers, sells or uses the access for profit.
Why it matters
This is a money problem for companies, and it can also help attackers. Google's expert John Hultquist warned that stolen AI power lets criminals run many cheap, automatic attacks. Companies need to lock down their AI keys and watch their bills closely so they can spot theft early.
What to watch
- Whether more companies find stolen API keys in their cloud accounts.
- How fast LLMJacking grows, since Google says it has risen steadily over the past two years.
- Whether services like Jet Night keep having outages as stolen keys are cut off.
Glossary
- LLM
- Large language model: a type of AI that reads and writes text, like a chatbot.
- LLMJacking
- When criminals take over someone else's AI account to use its paid AI services.
- API key
- A secret code that lets one program connect to and use another service.
- Mandiant
- A Google-owned security firm that investigates cyberattacks and helps companies recover.
- Jet Night
- A token routing service that the article says used stolen keys to offer cheap AI access.