Cloud credentials are worth more than most organizations realize. When attackers obtain an AWS access key, a GCP service account JSON, or a GitHub PAT with cloud permissions, the increasingly lucrative play is AI compute abuse: running millions of inference calls against models like Claude, GPT-4, and Gemini until the victim's cloud bill climbs to six or seven figures. Google GTIG and Mandiant documented and named this pattern LLMJacking.
The attack model
LLMJacking does not require a novel exploit. The entry point is almost always a credential that was already exposed: a secret in a public GitHub repository, an environment file in an unsecured storage bucket, a CI/CD pipeline variable leaked through a misconfigured job log, or a service account key that was never rotated. Once attackers validate the credential against a cloud provider's API, they check which AI services the account can reach and begin calling inference endpoints at scale.
How attackers find and steal credentials
- GitHub scraping: attackers continuously monitor newly pushed commits and forks before automated scanners flag them. Rotation after a scan miss means nothing if the credential was already cloned.
- Misconfigured object storage: environment files, Terraform state, and backup archives in public buckets are a persistent source. Exposure is frequently introduced inadvertently during infrastructure migrations.
- Supply chain compromise: a malicious or typosquatted package installed as a dependency can exfiltrate credentials to an attacker-controlled endpoint at install or runtime.
The financial blast radius
AI compute is expensive. A single large-context inference call can cost fractions of a cent, but at scale the numbers escalate fast. Mandiant observed LLMJacking campaigns generating compute bills exceeding USD 100,000 per day on a single compromised account before the victim noticed. Cloud providers typically hold the account owner responsible. Some offer forgiveness programs, but victims have faced bills in the high six figures before credits were applied.
CVE-2026-40217: LiteLLM privilege escalation
A compounding risk surfaced in October 2026: CVE-2026-40217, a privilege escalation in LiteLLM, the widely used open-source LLM proxy. The flaw allows an authenticated low-privilege user to escalate to administrator within the LiteLLM dashboard, then modify API key configurations to redirect model traffic to attacker-controlled endpoints. Organizations that self-host LiteLLM as a central AI gateway face significant exposure: one lateral movement step can compromise every model credential the proxy holds.
What defenders need to do
- Audit and rotate cloud IAM credentials: eliminate long-lived service account keys where workload identity federation or short-lived tokens can substitute. Run a secret scan across all repositories including private ones and their full git history.
- Enable spend alerts on AI services: AWS Bedrock, GCP Vertex AI, and Azure OpenAI all support budget alerts and anomaly detection. Set a threshold well below your expected monthly use; an unexpected spike is the fastest signal you will get.
- Patch LiteLLM immediately: upgrade to the release addressing CVE-2026-40217. Restrict the master key and enforce network-level access controls so the dashboard is not reachable from the public internet.
The durable lesson
LLMJacking is a symptom of a broader credential hygiene problem. The same exposed secret that enables cryptocurrency mining today enables LLMJacking tomorrow. The underlying remediation is consistent: secrets should not live in source control, rotation should be automated, and anomaly detection should be tuned to catch unusual spend before the monthly invoice arrives.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if your organization is reviewing cloud IAM posture or AI security controls.