A fresh breed of cloud crime is quietly inflating enterprise AI bills in 2026. It is called LLM-jacking, and it works by stealing cloud credentials, reaching into hosted AI services like Anthropic’s Claude or Google’s Gemini, and reselling that stolen access on underground marketplaces for a fraction of the retail price. Google’s Threat Intelligence Group (GTIG) laid out the scale of the problem in a September 8, 2026 report, and the numbers are blunt: underground demand for Claude and Gemini credentials has more than doubled year over year, and stolen access is showing up on gray-market relays at discounts as steep as 97%. The people footing the bill are not the criminals. They are the cloud customers whose credentials got stolen in the first place.
What Is LLM-Jacking, and Why It’s Suddenly Everywhere
LLM-jacking is not a new technique so much as an old one aimed at a new target. Attackers compromise a cloud account, usually through a leaked API key, an exposed server, or a vulnerable web application, and then check what AI services that account can reach. Once inside, they do not ransom data or mine cryptocurrency the way older cloud-hijacking campaigns did. Instead they run inference jobs against expensive frontier models, racking up usage that the account owner pays for while the attacker either profits directly or resells the access to someone else.
The term itself dates back to May 2024, when researchers at Sysdig coined “LLMjacking” after watching attackers use credentials stolen from a compromised server to reach roughly ten different hosted AI services running on AWS Bedrock. What has changed by late 2026 is scale and sophistication. GTIG’s new threat tracker, titled “From Prompting to Autonomy: The Evolution of Adversarial AI,” describes a shift from opportunistic credential abuse toward a structured criminal supply chain: automated discovery of exposed credentials, systematic validation against AI provider APIs, relay infrastructure that disguises stolen access as legitimate traffic, and dedicated marketplaces that sell subscriptions to that stolen capacity the way a legitimate SaaS vendor would sell seats.
CrowdStrike’s 2026 Threat Hunting Report adds another data point to that shift. It documented an 89% increase in AI-related adversary activity between July 2025 and June 2026, driven in large part by stolen API keys and session tokens for major AI platforms being resold on underground forums. That is not a niche problem anymore. It is a growth market for cybercriminals, and cloud security teams are only beginning to build detection for it.
Google’s September Threat Tracker: The Numbers Behind the Surge
GTIG’s threat tracker published on Google’s Cloud Blog is the most authoritative single source on LLM-jacking’s 2026 trajectory, and it pulls directly from posts tracked on underground forums rather than extrapolated estimates. The headline finding is that buyer demand for stolen Claude and Gemini credentials has climbed every quarter this year, with average underground account prices more than doubling across 2026 even as discounted bulk-access deals proliferate elsewhere in the same markets. GTIG also flagged rising demand for stolen access to autonomous coding tools, naming Cursor Pro and Devin-style agents alongside the usual chatbot subscriptions, which suggests the criminal market is tracking enterprise AI adoption patterns almost in real time.
That demand signal matters because it is a leading indicator, not a lagging one. When a stolen Claude account becomes more valuable to a criminal buyer, it means more attackers are actively hunting for exposed credentials that unlock Claude access specifically, whether through direct Anthropic API keys or through cloud-hosted paths like AWS Bedrock or Google Vertex AI. Pricing follows demand, and GTIG’s data shows that demand has not plateaued.
Inside the Underground Market: 97 Percent Off Claude, Gemini and GPT Access
The clearest illustration of how cheap stolen AI access has become comes from the Cloud Security Alliance’s Shadow Relay Market research note, published by its AI research lab in mid-2026. Researchers found relay operators advertising discounts as steep as 97.8% off official rates. In one documented case, an operator offered the equivalent of $3,333 in legitimate Anthropic API credit for roughly 425 Chinese yuan, about $59 at the time. The ten highest-traffic relays the researchers tracked pulled a combined 3.6 million visits a month, which points to a market with real, sustained customer demand rather than a handful of opportunistic sellers.
Separate reporting picked up by the Financial Times and repeated across multiple outlets, including TechRound’s coverage of the dark-web AI trade, cites GTIG findings that marketplaces are selling access to Anthropic, Google, and OpenAI models at discounts of up to 97%. A $200-a-month plan, in other words, can change hands on these forums for a few dollars. That pricing gap is what makes LLM-jacking commercially viable at scale: the stolen product is nearly free to acquire and nearly free to resell, while the compute cost is absorbed entirely by the original account holder’s cloud bill.
Operation Bizarre Bazaar: Anatomy of a 972-Attacks-a-Day Campaign
The most detailed single campaign documented so far is Operation Bizarre Bazaar, jointly reported by Sysdig and Pillar Security Research in February 2026. Honeypot infrastructure the two firms operated logged 35,000 attack sessions between December 2025 and January 2026, averaging 972 attacks per day. The campaign’s operators allegedly resold unauthorized access to more than 30 different LLM providers through a single underground gateway called silver.inc, advertising discounts in the 40% to 60% range below legitimate pricing.
What distinguishes Bizarre Bazaar from earlier, more scattered LLM-jacking incidents is the degree of organization. Rather than a single attacker quietly draining one victim’s Bedrock quota, the campaign functioned as a supply chain: automated reconnaissance tools (researchers pointed to reliance on internet-scanning services like Shodan and Censys) found exposed credentials at industrial scale, a validation layer checked which AI services each credential could reach, and a unified storefront sold that aggregated access to paying customers who likely never knew, or cared, that the capacity they were buying was stolen.
From a 2024 Laravel Bug to a 2026 Criminal Supply Chain
It is worth tracing how we got here. Sysdig’s original 2024 case involved CVE-2021-3129, a remote code execution flaw in the Laravel PHP framework, which attackers used to pull cloud credentials off a compromised server and then test those credentials against roughly ten hosted AI services. By September 2024, that same style of attack had generated more than 85,000 requests against AWS Bedrock over several months, with Sysdig estimating potential exposure above $100,000 per day for victims running expensive frontier models and above $46,000 per day even for more modest usage levels.
Two years later, the mechanics are largely the same, but the business model around them has matured into something closer to organized retail. Where 2024’s LLM-jacking was mostly opportunistic, 2026’s version features dedicated marketplaces, tiered pricing, and demand tracking that mirrors legitimate SaaS analytics. That is the throughline GTIG draws in its September report: individual credential theft evolving into a structured criminal economy built specifically around AI compute.
The FinOps Blind Spot: How Hijacked Compute Shows Up on the Invoice
LLM-jacking is, at its core, a FinOps problem wearing a security costume. Traditional cloud cost anomaly detection looks for sudden spikes in compute, storage, or network spend. AI inference spend does not always trip those alarms the same way, especially at organizations that have already scaled up legitimate AI usage and come to expect volatile, fast-growing AI line items. Google’s threat tracker reporting, cited by independent analysis site The Clarity, notes that the cost signals from hijacked AI workloads are often indirect: burned compute quotas, model intellectual property leaving healthcare and media companies through unauthorized inference, and more than 100 million distillation prompts aimed at Google’s audio, video, and image models by parties who never paid for that access.
That last point deserves emphasis. Distillation abuse, where an attacker queries a model repeatedly to extract its behavior and train a cheaper competing model, is a different kind of damage than a direct billing hit. It is intellectual-property theft that happens to ride on the same stolen-credential pathway as straightforward compute abuse, and it rarely shows up as a dollar figure on anyone’s invoice until the competing model ships.
Case Study: An $82,000 Gemini Bill in 48 Hours
The clearest illustration of direct financial damage comes from a March 2026 incident described in BeyondScale’s LLMjacking defense guide. A developer’s single stolen API key generated an $82,000 Gemini API bill in just 48 hours. BeyondScale’s broader analysis puts the ceiling for this kind of abuse at roughly $100,000 per day in stolen AI compute, consistent with Sysdig’s earlier Bedrock-era estimates, and notes that stolen LLM API credentials themselves sell for as little as $30 per account on underground forums before being resold at 40% to 60% below legitimate market pricing.
The math is what makes LLM-jacking attractive to criminals and dangerous to victims at the same time. A $30 investment in a stolen credential can unlock tens of thousands of dollars in compute before anyone notices, and the resale market means a single stolen key can generate revenue for an attacker long after the original theft, as different buyers cycle through the same compromised access.
Why Kubernetes Sits at the Center of the Attack Surface
Most AI workloads, including the inference pipelines and agent frameworks attackers are now targeting, run on managed Kubernetes. That makes the control plane itself part of the LLM-jacking story, even when the headline attack is credential theft rather than a Kubernetes-specific exploit. A compromised pod or an overly permissive service account inside a cluster can be exactly the kind of exposed credential GTIG describes being harvested and tested against AI provider APIs.
Google’s own Kubernetes Engine security bulletin, published September 9, 2026 and tracked as GCP-2026-061 (GHSA-p7v4-vr35-mj6f), describes a missing authorization check that Google patched across GKE clusters by adding the missing check server-side. The bulletin also carries a separate, longer-term signal: GKE on AWS and GKE on Azure are both in maintenance mode and scheduled to shut down on March 17, 2027, which will push workloads currently running on those hybrid offerings toward native EKS, AKS, or straight GKE deployments over the next several months.
How AWS, Azure and Google Cloud Are Patching the Control Plane
All three major managed Kubernetes services moved on new versions in the same narrow window this October, which is a useful snapshot of how fast the underlying infrastructure is changing even as the LLM-jacking threat grows around it.
| Cloud Provider | Latest Kubernetes Version | Status as of October 2026 | Notable Detail |
|---|---|---|---|
| Amazon EKS / EKS Distro | 1.37 | Generally available since Oct 2, 2026 | Available in all AWS regions, including GovCloud |
| Azure AKS | 1.37 (Preview) | Rolling out October 2026 | Patch releases 1.36.3, 1.35.7, 1.34.10 also shipped; version 1.29 deprecated under AKS LTS |
| Google GKE | Security patch GCP-2026-061 | Published Sept 9, 2026 | GKE on AWS and GKE on Azure scheduled to shut down March 17, 2027 |
None of these releases are direct responses to LLM-jacking. But the pace of patching matters because every unpatched cluster, every stale service account, and every overly broad IAM role is a potential entry point into the same credential-harvesting pipeline GTIG described. Security teams tracking LLM-jacking exposure cannot treat it as purely an AI-provider problem; it is a cloud identity and Kubernetes hygiene problem wearing an AI hat.
Competitive Comparison: Bedrock, Azure AI Foundry and Vertex AI Defenses
AWS Bedrock carries the longest documented history of LLM-jacking abuse, dating back to Sysdig’s original 2024 research, which makes it the most-studied attack surface among the three major managed AI platforms. That history has pushed AWS toward more granular usage monitoring inside Bedrock over the past two years, though the available 2026 reporting does not give a numeric comparison of how effective that monitoring has been against the current wave of attacks.
Google’s position is more complicated. GTIG is simultaneously the industry’s most active public researcher on LLM-jacking and, through Gemini and Vertex AI, one of the two most targeted brands according to its own data. That dual role, defender and target, is part of why its September threat tracker reads as more candid than typical vendor security marketing. Anthropic’s Claude is the other top target named in GTIG’s reporting, consumed by attackers both directly through the Anthropic API and indirectly through Bedrock and Vertex AI hosting.
Azure’s exposure is harder to quantify from the public record. None of the sourced 2026 research reviewed for this article provides a comparable numeric ranking showing Azure AI Foundry’s LLM-jacking exposure relative to Bedrock or Vertex AI, which is itself worth noting. It may reflect lower attacker interest, less aggressive public disclosure, or simply a gap in current threat-intelligence coverage. Enterprises standardized on Azure should not read that silence as safety.
Market Impact: Cloud Security and FinOps Spending Responds
LLM-jacking is starting to reshape how enterprises budget for both cloud security and AI governance. The combination of a documented $82,000 bill accrued in 48 hours and GTIG’s warning that underground demand has more than doubled year over year gives CFOs and CISOs a concrete, dollar-denominated reason to fund AI-specific cost anomaly detection, something that was often treated as a lower priority than traditional cloud cost controls. FinOps teams that built their tooling around compute and storage anomalies are now being asked to extend that same discipline to token-level AI usage, which behaves differently and spikes faster than conventional cloud spend.
Security vendors are responding too. Sysdig and Pillar Security Research’s joint work on Operation Bizarre Bazaar functions as both research and a product pitch: the firms that can detect stolen-credential reuse against AI APIs fastest stand to capture a growing segment of cloud security budgets. Expect runtime detection, AI-specific identity governance, and non-human-identity (NHI) management, the category covered by outlets like NHI Mgmt Group’s own LLM-jacking tracker, to see increased enterprise spending through the rest of 2026 and into 2027 as more companies treat AI credentials as a distinct, high-value asset class that needs its own controls.
Historical Context: How Credential Theft Became an AI Business
Cloud credential theft is not new; attackers have hunted for exposed AWS keys, service account tokens, and SSH credentials for well over a decade, usually to mine cryptocurrency or build botnets. What LLM-jacking represents is that same old playbook pointed at a new, more lucrative payload. Crypto-mining abuse generates value measured in fractions of a cent per compute-hour at current mining difficulty. Frontier AI model access, by contrast, can be resold at a meaningful fraction of retail SaaS pricing, which is why GTIG’s data shows criminal demand concentrating specifically on premium accounts like Claude and Gemini rather than spreading evenly across all available cloud compute.
The two-year arc from Sysdig’s original Laravel-exploit case in 2024 to Operation Bizarre Bazaar’s organized marketplace in early 2026 mirrors how other cybercrime categories have professionalized before, ransomware-as-a-service being the clearest precedent. Early ransomware operators worked alone or in small crews; within a few years, affiliate programs, leak sites, and negotiation services turned it into an industry. LLM-jacking appears to be following the same curve, just compressed into a much shorter timeline because the underlying AI market itself is moving so fast.
Underground vs. Legitimate AI Access Pricing
The pricing data collected across multiple 2026 research efforts shows a consistent pattern: stolen or relayed AI access undercuts legitimate pricing by roughly half to nearly entirely, depending on the channel.
| Source / Channel | Example Pricing | Discount vs. Legitimate Rate | Reported By |
|---|---|---|---|
| Shadow Relay Market (Anthropic credit resale) | ~$59 for $3,333 in API credit | 97.8% off | Cloud Security Alliance |
| General Claude / Gemini / GPT marketplace access | A few dollars for a $200/mo plan | Up to 97% off | GTIG, via Financial Times reporting |
| Operation Bizarre Bazaar (silver.inc gateway) | 30+ LLM providers through one storefront | 40% to 60% off | Sysdig / Pillar Security Research |
| Standalone stolen account credential | As low as $30 per account | Resold at 40%-60% below market | BeyondScale |
| GTIG-tracked average underground account price | More than doubled year over year in 2026 | Demand-driven price increase | Google Threat Intelligence Group |
Notice that two of these rows point in opposite directions. Bulk relay access gets cheaper as operators compete for volume buyers, while individual premium accounts, the kind that unlock unthrottled Claude or Gemini access, get more expensive as buyer demand for those specific credentials climbs. Both trends tell the same underlying story: the market for stolen AI access is deep enough now to support real price discovery.
Detecting Hijacked AI Usage: A Starting Point
Security teams responding to LLM-jacking exposure are generally starting with the same category of control: scoped IAM policies for AI service calls, paired with usage-pattern alerting rather than simple cost-threshold alerting. A narrowly scoped Bedrock invocation policy, for example, looks something like this.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "bedrock:InvokeModel",
"Resource": "arn:aws:bedrock:us-east-1::foundation-model/anthropic.claude-*",
"Condition": {
"StringEquals": { "aws:RequestedRegion": "us-east-1" },
"NumericLessThanEquals": { "bedrock:MaxTokens": "4096" }
}
}
]
}That kind of scoping will not stop a determined attacker who already holds a valid credential, but it limits blast radius and makes anomalous invocation patterns, such as sudden requests from an unfamiliar region or token volumes far above a service account’s normal baseline, easier to flag. Pairing that scoping with CloudTrail, Azure Monitor, or Cloud Audit Logs alerting tuned specifically for AI service invocation is the practical next step most of the sourced research points toward.
Predictions: Where LLM-Jacking Goes Next
Based on the trajectory documented through GTIG, CSA, Sysdig, and CrowdStrike’s 2026 reporting, several outcomes look likely over the next 12 to 18 months. These are editorial projections, not sourced facts.
- FinOps platforms will add AI-specific anomaly detection as a standard feature rather than a bolt-on, following the same pattern cloud cost tools took with general compute anomalies a few years ago.
- Underground AI-access marketplaces will continue consolidating around a small number of dominant storefronts, similar to how silver.inc aggregated 30-plus providers into one relay, since buyers prefer a single checkout over scattered sellers.
- Cloud providers will tighten default IAM scoping for AI service calls, given that GTIG’s own data traces the problem back to over-permissioned credentials rather than flaws in the AI models themselves.
- Expect contract disputes over who absorbs stolen-compute charges, insurer versus customer versus cloud provider, as six-figure LLM-jacking bills become common enough to reach litigation.
- As GKE on AWS and GKE on Azure wind down ahead of their March 2027 shutdown, AI workloads migrating to native control planes will create a short-term window of misconfiguration risk that LLM-jacking campaigns are likely to probe.
What This Means for Enterprise Cloud Teams
The practical takeaway for any organization running AI workloads on AWS, Azure, or Google Cloud is that credential hygiene is now directly tied to AI cost control, not just data security. A leaked service account token used to be a breach-notification problem. In 2026, it is also a potential five- or six-figure billing event, and the two risks compound each other since the same exposed credential that lets an attacker read sensitive data can just as easily let them run thousands of dollars in Claude or Gemini inference before anyone notices.
That dual exposure is why GTIG, CSA, and the Sysdig-Pillar research all converge on the same basic recommendation: treat AI service credentials with the same rigor applied to production database credentials, including short-lived tokens, strict scoping, and dedicated usage monitoring, rather than folding them into generic cloud IAM policies that were designed before AI inference became a major line item on the cloud bill.
Frequently Asked Questions
What is LLM-jacking?
LLM-jacking is the use of stolen cloud or API credentials to access hosted large language models like Claude, Gemini, or GPT without authorization, either to run AI workloads for free or to resell that access to other buyers on underground marketplaces.
How much can LLM-jacking cost a victim organization?
BeyondScale documented a case where a single stolen API key generated an $82,000 Gemini bill in 48 hours, and estimates from Sysdig and BeyondScale put potential daily exposure as high as $100,000 for organizations whose credentials unlock expensive frontier models.
Which AI models are most targeted by LLM-jacking?
Google’s Threat Intelligence Group reports that underground demand concentrates most heavily on Anthropic’s Claude and Google’s Gemini credentials, with OpenAI access also appearing in marketplace listings alongside autonomous coding tools like Cursor Pro.
How is LLM-jacking different from older cloud credential theft?
Older cloud-hijacking campaigns typically mined cryptocurrency with stolen compute. LLM-jacking instead targets AI inference specifically, because stolen access to premium models can be resold at a significant fraction of retail SaaS pricing rather than converted into low-value mining output.
What was Operation Bizarre Bazaar?
Operation Bizarre Bazaar was an LLM-jacking campaign documented jointly by Sysdig and Pillar Security Research in February 2026. It generated 35,000 attack sessions against honeypot infrastructure between December 2025 and January 2026, averaging 972 attacks per day, and resold access to more than 30 LLM providers through a gateway called silver.inc.
Is Kubernetes directly vulnerable to LLM-jacking?
Kubernetes is not the direct cause of LLM-jacking, but most AI inference workloads run on managed Kubernetes, which makes cluster misconfigurations and over-permissioned service accounts a common path to the credentials attackers need. Google, AWS, and Microsoft all shipped Kubernetes patches and version updates in October 2026 that touch this attack surface.
How can enterprises detect LLM-jacking attempts?
Recommended practices include scoping IAM policies narrowly around specific AI models and regions, monitoring token volume and invocation patterns rather than relying solely on cost thresholds, and treating AI API credentials with the same short-lived-token discipline applied to production database access.
Where can I read the primary research on LLM-jacking?
Google’s Threat Intelligence Group published its most recent findings on the Google Cloud Blog in September 2026, and the Cloud Security Alliance has published two detailed research notes on the underground relay market and black-market AI model hijacking through its AI research lab.
