What is API key theft (LLMjacking)? Stolen AI keys now power hacking tools — on the victim's bill
API key theft, also called LLMjacking, means stealing someone's AI provider API key and running models on their account and bill. Bitsight research published October 16, 2026 describes MONST3R-AI, a criminal 'autonomous pentest' tool with no model of its own that runs on stolen OpenAI, Anthropic and Google keys, so victims pay and attackers stay hidden behind their accounts
The three lines
- Definition — using someone else's API key to run AI; the owner gets the bill
- Trend — across 16 forums, AI talk up 45%, ransomware mentions down 49%
- Defense — treat a leaked AI key like a leaked cloud credential; cap spend, rotate fast
Key questions
- What to do if your OpenAI API key is leaked
- **Revoke it immediately and issue a new one.** | Step | Action | |---|---| | 1 | Revoke the key in the console | | 2 | Issue a new key; update code and servers | | 3 | Check usage and billing for anomalies | | 4 | Purge the key from git history | | 5 | Report misuse to the provider |
- LLMjacking meaning
- **Unauthorized use of a large language model account through stolen credentials.** | Part | Detail | |---|---| | What's stolen | API keys, session tokens | | How | Public repos, infostealer malware | | Victim harm | Charges, suspension, implication in crime | | Attacker gain | Free compute, cover |
- MONST3R-AI
- **A tool sold on criminal forums as an 'autonomous penetration testing platform.'** | Item | Detail | |---|---| | Own model | None | | Operation | Buyer adds stolen keys, sets budget cap, lists targets | | Seller claim | 1,072 findings on 199 hosts (unverified by Bitsight) |
An AI API key works like a credit card: whoever holds it spends, and the owner gets the statement. API key theft — "LLMjacking" — is stealing someone's AI provider key and running models on their account. Bitsight research published on October 16, 2026 shows those keys are now sold as fuel for hacking tools.
An API key is a long string a program presents to prove "I am this account." Unlike a password it passes through no login page and no two-factor check. Anyone with the key can use the account.
1. How keys leak
| Route | Example | Prevalence |
|---|---|---|
| Public repositories | Config files pushed to GitHub | Most common |
| Infostealer malware | Lumma, Vidar harvesting keys and tokens from PCs | Reported in September |
| Client-side code | Keys embedded in browser JavaScript | Beginner mistake |
| Plugins and agent tools | Unvetted MCP servers and plugins | Bitsight warning |
| Resold access | Shared or brokered accounts | Observed by Sophos |
Bitsight highlights a campaign called FakeGit that used about 7,600 fraudulent GitHub repositories to spread malware; more than 800 posed as AI skills or MCP servers, including a lookalike "Docker MCP Gateway." Installing AI tooling has become a way to lose keys.
2. What stolen keys buy — MONST3R-AI
| Item | Detail |
|---|---|
| What it is | Sold on a criminal forum as an "autonomous penetration testing platform" |
| Own model | None |
| Use | Buyer pastes stolen OpenAI, Anthropic, Google keys, sets a budget cap, supplies targets |
| Who pays | The key owner |
| Seller claim | 1,072 findings across 199 hosts (unverified) |
| Resale prices | One reseller offered models at ~$0.10 per million tokens |
The model serves two goals. Money: attackers pay nothing for expensive inference. And cover: the provider's logs show the victim's account, not the attacker. Victims face surprise bills and, at worst, suspension for abuse they didn't commit.
Bitsight's analysis of thousands of posts on 16 underground forums from February to August 2026 shows the shift:
| Indicator | Change |
|---|---|
| AI-related discussion overall | +45% |
| Agents, indirect prompt injection, MCP | +67% |
| Jailbreak discussion | ~+75% |
| Vibe coding mentions | More than doubled |
| Ransomware mentions | −49% |
| Phishing mentions | −8.5% |
| Branded criminal chatbots (WormGPT etc.) | −8.7% |
Criminals are moving from bespoke "evil" chatbots to legitimate frontier models accessed with stolen keys.
3. How to protect keys
| Measure | How |
|---|---|
| Keep keys out of code | Environment variables or a secrets manager; never commit .env |
| Spend caps | Monthly budget and alerts in the provider console |
| Separate keys | One per project or purpose to limit blast radius |
| Rotate | Issue new keys on a schedule |
| Scan | Turn on secret scanning in repositories |
| Vet tools | Install MCP servers and plugins only from trusted sources |
| Human approval | Gate local coding agents' access to sensitive folders and shell commands |
Bitsight's one-line advice: treat a leaked AI key as seriously as an exposed AWS credential. The cost isn't just tokens; your key can be used to attack someone else.
4. FAQ and unknowns
| Question | Answer |
|---|---|
| Do I owe charges from stolen use? | Depends on provider policy; report immediately |
| Is deleting the key enough? | Revoke and replace; it may persist in git history |
| Are ordinary app users at risk? | Mostly developers who hold keys; app-only users less so |
- Scale: no public total for stolen keys or losses.
- Seller claims: MONST3R-AI's performance claims are unverified.
- Related: delegating access without sharing secrets is explained in "What is OAuth?", and copying a model by flooding it with queries in "What is a distillation attack?"