Stolen cloud keys fuel a resale market for LLM access

Criminals are using stolen cloud credentials to reach large language models inside victims' accounts and then reselling that access to other people, according to a report published by Dark Reading on 3 November 2026. The report describes the practice, known as LLMjacking, as a thriving business rather than opportunistic one-off abuse. Some affected organisations ran up as much as $1 million in resource-consumption charges before the unauthorised access was revoked.

The mechanics are simple enough to explain in a sentence. Cloud providers bill customers for the compute used when a model answers a prompt, so anyone holding a valid set of credentials can spend the account owner's money at speed. The victim does not lose data in the usual sense; they lose budget, and they do so quietly, because inference traffic looks a lot like ordinary application traffic until the invoice arrives.

What makes the Dark Reading account notable is the word "enterprise". The report frames reselling as the business model: the person who steals the credentials is not necessarily the person who uses them. Access is passed on to buyers who want model capacity without paying for it, or without the identity checks and usage policies that come with a legitimate account. That division of labour is familiar from other parts of the criminal economy, and it tends to make abuse more persistent, because a resold credential has a customer base keeping it in use.

The root cause recorded for this activity is misconfiguration rather than a flaw in any model or any single vendor's product. Credentials that should have been short-lived, scoped narrowly or stored somewhere other than a code repository end up in the wrong hands, and the permissions attached to them are broad enough to invoke expensive model endpoints. No specific vendor or product was named in the report, and no named victims were identified.

For teams running agents or model-backed applications, the practical lesson is about blast radius. A credential that can call a model is a credential that can spend money without limit unless someone has set a limit. Spending caps, per-key quotas, alerting on unusual inference volume and short credential lifetimes are the controls that turn a $1 million surprise into a small one. None of this is specific to AI, but the cost curve is steeper than it is for storage or ordinary compute, which is why the bills in the report are so large.

It is also worth noting what the report does not say. It does not attribute the activity to a particular group, does not say how many organisations have been affected, and does not give a timeline for when the abuse began or how long individual intrusions lasted. It does not describe the method used to obtain the credentials in any given case. The $1 million figure is presented as an upper end among victims, not as a typical loss.

The status of the activity is reported rather than resolved. Access was revoked in the cases described, but the report presents LLMjacking as an ongoing commercial practice rather than a closed incident. Organisations that have issued cloud credentials with model access and have not reviewed them recently are the obvious population at risk.