Fireworks AI breach also exposes billing data and model weights
Later access on October 23 through a third-party cloud host reached R&D machines; card numbers were not stored.
Stories per day · 30 days
4 RSS
Relatedcredential-theft10cloud6api-keys4cryptomining4fireworks-ai4model-weights4aoki3claude3data-breach3honeypot3infostealer3litellm3mcp3pypi3railway3supply-chain3symantec3ai-security2
37 stories, newest first · one card per story
Stories tagged #llmjacking
Railway says attacker stole secrets and incurred about $740,000 in charges
An upper limit of about 100,000 workspaces may have had environment variables decrypted; Railway reset 1,852 tokens.
1
Trezor implant, LLMJacking bills hit $1M reported
Reports include Trezor hardware wallet found with implant, LLMJacking where attackers generate bills up to $1M using hijacked AI access, and Chainalysis breach exposing password hashes.
1
Google Warns of LLMJacking Attacks Generating Over $100,000 Daily
Attackers hijack enterprise LLM access to run up massive fraudulent charges before access is revoked.
1
Hackers launch LLMJacking attacks, generating $1M cloud bills
Attackers abuse stolen LLM credentials via LLM Mixers, reselling access while passing bills to victims across continents.
1
Google identifies LLMjacking attacks generating $1 million in cloud AI charges
Researchers observe LLMjacking attacks using stolen API keys leading to fraudulent charges exceeding $100000 per day at some organisations.
1
LLMJacking Emerges as Thriving Cybercriminal Enterprise
Cybercriminals resell stolen cloud access to commercial LLMs, with victims charged up to $1 million in resources before access is revoked.
1
Google Warns of LLMJacking Threat Causing Up to $1M Charges
Google Mandiant detected LLMjacking incidents in finance retail technology and transportation sectors with cumulative charges reaching $1 million.
1
Criminals use stolen AI access to rack up $1 million cloud bills
GTIG and Mandiant report LLMJacking attacks causing bills up to $1 million via stolen cloud credentials.
1
Stolen LLM API tokens driving illicit charges above $100,000 a day
Mandiant says some victims reached about $1 million before cutting access; one intruder made over 500,000 calls in under eight hours.
1
Threat Actors Use LLMJacking to Monetize Compromised Cloud Models
Mandiant documented LLMJacking intrusions where threat actors hijacked enterprise LLM access for fraudulent charges exceeding $1M cumulatively across multiple sectors.
2
Northflank security breach leads to unauthorized AI API key usage
Northflank reported possible exposure of environment variables containing AI API keys after a Wiz threat alert, urging customers to rotate secrets.
1
Northflank breach leads to abuse of customers' AI API keys
Customers must assume environment variables were decrypted; Northflank has not said how attackers got in or how many were affected.
1
Nine AI developer platforms disclose October credential incidents
Wiz ties later Bedrock abuse of enterprise keys to vendor breaches, including about 800,000 and 1.7 million calls.
5
Symantec honeypot captures Skynet agent hijacking exposed AI models
The jailbroken agent can run up to 100,000 steps to scan, steal secrets, and mine cryptocurrency on the victim’s bill.
1
Unrevoked LiteLLM key used to publish credential-stealing PyPI package
Microsoft said the malware ran on every Python startup, and stolen AWS keys were checked against Amazon AI models.
Honeypot captures agent that hijacks exposed AI models
The captured prompt tells a stolen model to scan, exploit web apps, steal secrets and mine, for up to 100,000 steps.
Malicious LiteLLM v1.107.0 on PyPI and Docker stole credentials
The build stayed up for under two hours on PyPI; anyone who installed it is told to rotate credentials, not only upgrade.
3
Symantec finds AI agent hijacking exposed models for autonomous attacks
A honeypot captured a five-layer jailbreak and a loop of up to 100,000 steps that scans, steals data, and installs XMRig.
5
Railway says intruder may have read customer environment secrets
A subset of Railway users may have had decrypted API keys and credentials exposed; the company urges rotation and has revoked its own tokens.
Malicious LiteLLM 1.107.0 published after suspected token leak
Unpinned installs for a few hours on October 21 pulled a credential stealer and an hourly remote-code backdoor.
3
Symantec honeypot captures AI agent built for autonomous attacks
Instructions covered up to 100,000 actions, including scanning, credential theft and Monero mining, and were not executed.
1
Phishing campaign uses stolen GCP access to bill victims for LLMs
Attackers phished MFA codes, linked foreign projects to victim billing, and kept Gemini prompts hidden from the organization.
2
New Aoki Malware Targets ChatGPT, Claude, Codex and Gemini to Steal Credentials
Symantec says infostealer Aoki now steals local sessions and credentials for ChatGPT, Claude, Codex, Cursor, and Gemini.
8