LLMjacking after Black October: how to stop stolen AI keys becoming somebody else's compute budget

What happened

Wiz published "Black October" on 30 October, describing a series of security incidents at AI developer and hosting platforms during the month¹. Several platforms attributed their incidents to credential access, and the common thread was stored environment variables holding AI keys; Wiz found no single shared vulnerability and linked key-checking activity to resellers of model access, without claiming they carried out the intrusions¹². In the same week, a tampered coding extension tried to plant backdoors on developer machines, the kind of foothold that exposes whatever keys a laptop holds⁵.

The pattern has a name. Sysdig described LLMjacking in 2024: attackers use stolen cloud credentials to reach hosted model services, check which keys work, and resell the access, leaving victims with the bill³⁴. What has changed is scale: more teams, more platforms and more keys, often with no spending limits.

Why AI keys are different

A leaked database password is serious, but its damage is bounded by what is in the database. A leaked model key with no limits turns directly into spend, at machine speed, and the first sign is often the invoice. AI keys also spread more widely than most secrets: into notebooks, hosted dev platforms, CI variables, editor settings and personal accounts, because getting started with AI is designed to be easy.

A practical playbook

1. Find every key. Inventory provider accounts, cloud model services and keys across teams, platforms and CI. Rotate anything stored on a platform named in the Wiz report or any third-party platform you cannot vouch for¹.

2. Put a gateway in front of models. Applications and developers call your gateway, not providers directly. The gateway holds the real provider credentials, issues per-team or per-application keys, and enforces quotas. A key stolen from a laptop is then a key to your gateway, with your limits and your logs. See model routing and securing AI coding tools.

3. Set spend and rate limits per key. Every key gets a daily budget and an alert well below it. Production keys get headroom; experiment keys do not.

4. Use cloud identity instead of static keys where you can. For cloud-hosted models, prefer workload identity and short-lived credentials over long-lived access keys, and restrict which models and regions each identity can use. Sysdig's research noted that not every model API call appeared in default cloud audit logs, so check that your logging covers the calls you rely on³.

5. Watch usage like a security signal. Record tokens, model and caller on every request. The OpenTelemetry generative AI conventions capture model and token usage per call, which gives you the baseline that anomaly alerts need⁶. See AI cost allocation.

6. Rehearse revocation. Know how to revoke a key, rotate provider credentials behind the gateway and confirm usage stopped, in minutes, outside office hours.

What to alert on

Who should act

• Any team using hosted AI dev platforms: rotate keys stored there this week.
• Companies with cloud-hosted models: review which identities can invoke which models, and in which regions.
• Finance and FinOps: add AI spend to daily anomaly checks, not monthly reviews.
• Regulated firms: a stolen key that can reach customer data through a model is a data incident, not just a cost problem; see where I work for regional rules.

CTO take

October showed that attackers now go after AI keys directly, because those keys turn straight into resellable compute. The fix is not exotic: one gateway, keys per team, limits per key, telemetry per call and practised revocation. Teams that already run AI through a gateway for cost and quality reasons get most of this for free. Teams that do not should start there. For the wider week, see the 1 November tech news.

How I can help

I help teams design AI gateways, key management and spend controls that keep model access safe and affordable. I am based in India, the United States and the UAE, working globally. See AI architecture or analyse your challenge and bring the result to a call.