Key Highlights:
- LLM jacking allows attackers to use stolen AI API keys and AI computing power to access expensive models through victims’ accounts.
- Railway reported approximately $740,000 in unauthorized AI usage after a security breach that potentially exposed credentials from up to 100,000 workspaces.
- Google warns that fraudulent AI usage can exceed $100,000 in a single day, making credential security and spending controls increasingly important.
The rising use of artificial intelligence is creating a new target for cybercriminals, which is the AI computing power behind the models. Hackers are stealing API keys and cloud credentials to access expensive large language models (LLMs) through other people’s accounts, leaving businesses to deal with unexpected bills.
It is known as LLM jacking which can turn compromised developer platforms into sources of unauthorized computing power. Recent incidents involving Railways and Zeabur have emphasized the financial and security risks facing companies that store AI credentials in their infrastructure.
How Does LLM Jacking Affect AI Computing Power?
LLM jacking is a form of resource hijacking in which attackers gain unauthorized access to AI models through exposed or stolen API keys, cloud identity tokens and other credentials. Instead of paying for their own AI usage, attackers send model requests through compromised accounts, transferring the cost to the legitimate account holders.
As per Google Threat Intelligence Group and Mandiant, attackers obtain access through exposed cloud credentials, service account keys, GitHub personal access tokens and active session tokens. They may also search public code repositories for exposed AI API keys or exploit vulnerabilities in cloud applications and AI routing software.
Once inside, attackers can create additional API keys, enable AI services, launch high-volume inference requests and set up proxy infrastructure to resell stolen model access. These underground services, known as LLM Mixers, pool compromised credentials and route requests through different accounts, making the activity harder to trace. Google reported that some organizations faced more than $100,000 in fraudulent charges in a single day, with cumulative costs reaching $1 million in certain incidents.
Railway and Zeabur Breaches Highlight the Financial Impact
The recent incidents show how quickly compromised credentials can translate into significant financial losses. Railway, a cloud development platform, disclosed a major security incident involving attackers who exploited vulnerabilities in its build infrastructure and gained access to internal systems. The attackers subsequently accessed customer environment variables, which can contain AI provider API keys and other sensitive credentials.
In its November 10 incident report, Railway said that environment variables from a maximum of approximately 100,000 workspaces could have been decrypted. This represented an upper limit of potentially affected workspaces, not a confirmed count of compromised accounts. Railway estimated that unauthorized AI usage on stolen keys reached approximately $740,000. It also said attackers appeared to be targeting AI provider credentials for resale and use in AI model distillation.
The Wall Street Journal reported that the Railway incident involved around $371,000 in cryptocurrency theft, in addition to the fraudulent AI charges. Zeabur also disclosed a security incident in August 2026. Its investigation found that attackers exploited a vulnerability in a publicly accessible user service to enter a shared cluster and eventually access production systems. They obtained project environment variables containing third-party API keys, cloud credentials and database passwords.
However, Zeabur’s official report said that the attacker-created AI Hub keys generated no AI Hub usage or charges. Google’s findings suggest that these incidents are part of a wider threat pattern rather than isolated cases, The company expects attackers to target AI infrastructure as demand for advanced models and agent-based services grows.
To reduce the risk, organizations should store credentials in centralized secrets-management systems, rotate exposed keys, restrict permissions, enable phishing-resistant multi-factor authentication and monitor unusual API activity. Google also recommends setting model-specific usage quotas, spending limits and alerts to identify suspicious consumption before costs escalate.
