LLMjacking: Exposed AI Endpoints, Stolen Keys and Cost Controls

LLMjacking turns someone else’s model access into an attacker’s computing resource. The exposed asset might be a paid provider key, a cloud identity allowed to invoke models, or a self-hosted inference endpoint that accepts requests from anyone. The immediate loss is unauthorized consumption; access to files, internal systems, or tools is a separate question that depends on the surrounding application.

The useful response is therefore concrete: identify which identities can invoke which models, check whether callers can bypass the gateway, and establish where an unauthorized request is stopped before it consumes resources. A model’s refusal to answer a harmful prompt does not establish that these controls work.

What the October 21 Skynet report actually establishes

In its October 21, 2026 report, Symantec describes an AI honeypot capturing an offensive agent’s instructions during the summer of 2026. The request included 74 tool definitions and a directive permitting up to 100,000 unattended steps. These describe the operator’s intended capability, not a demonstrated run of that length.

The distinction changes how the evidence should be read. The honeypot executed none of the tool calls. Three earlier results appeared inside attacker-supplied conversation history, involved a training-platform target, and reported no discovered flaw. The honeypot returned a fallback response and the session ended. A separate mining-script request was also captured without execution. The report supports a concrete finding about attempted abuse and attacker design; it does not establish successful compromise of every product named in that design.

For defenders, the practical question is whether an untrusted caller can obtain useful inference under an identity that belongs to someone else. The following checks focus on that boundary rather than trying to reproduce the captured offensive agent.

Four problems that need different controls

These failures can coexist, but treating them as interchangeable leads to incomplete fixes. A prompt filter does not revoke a stolen key. A gateway budget does not protect a provider credential that remains usable outside the gateway. A sandbox can restrict tool execution while still allowing an unauthorized caller to consume all available inference capacity.

Historically, Sysdig’s May 6, 2024 investigation described stolen cloud credentials being used to investigate access to model services and a proxy associated with compromised accounts. That precedent matters because an operator can suffer LLMjacking even when its own application never exposes a public chat endpoint. Review cloud identities and upstream keys alongside the application perimeter.

A local API is not automatically a private API

Ollama’s authentication documentation states that its local API does not require authentication, while direct cloud API access requires a key. That is a documented trust assumption, not proof that every Ollama deployment is exposed or vulnerable. The security result depends on binding addresses, published container ports, reverse proxies, tunnels, and the network that can reach the service.

Map the complete route from the intended caller to the inference process. A service listening on loopback can still be made public by a tunnel. A container reachable only through an authenticated gateway can become directly reachable after a port-publishing change. A health check that succeeds proves reachability; it does not prove that inference, model management, and administrative routes share the same authorization rules.

Create an inventory with an owner, public hostname, backend address, approved caller identities, upstream credential reference, and expected network exposure. Record secret references rather than secret values. Include temporary demo environments and developer tunnels: a forgotten test service can consume a production provider key even if the production application is well protected.

Test rejection without generating a real bill

Start in a staging environment that uses a non-billable mock upstream. Preserve the actual ingress and authentication path, but replace inference with a counter or deterministic response. This lets the test answer the important question: did a rejected request reach dispatch? HTTP status alone is insufficient if middleware returns an error after an upstream call has already begun.

The local example below illustrates that ordering. It is a standard-library teaching fixture, not a production gateway or a test of any named product. It binds only to loopback, accepts no real provider credentials, performs no inference, and keeps its small allowance only in memory. Restarting resets the allowance.

# Save as local_gate.py. Python 3; no external dependencies.
import hmac
import json
from http.server import BaseHTTPRequestHandler, HTTPServer

TOKEN = "local-demo-only"
remaining = 2
dispatches = 0

class Gate(BaseHTTPRequestHandler):
    def reply(self, status, payload):
        body = json.dumps(payload).encode()
        self.send_response(status)
        self.send_header("Content-Type", "application/json")
        self.send_header("Content-Length", str(len(body)))
        self.end_headers()
        self.wfile.write(body)

    def do_POST(self):
        global remaining, dispatches
        if self.path != "/demo/infer":
            self.reply(404, {"error": "unknown_route"})
            return
        supplied = self.headers.get("Authorization", "")
        if not hmac.compare_digest(supplied, "Bearer " + TOKEN):
            self.reply(401, {"error": "unauthorized"})
            return
        if remaining <= 0:
            self.reply(429, {"error": "demo_allowance_exhausted"})
            return
        remaining -= 1
        dispatches += 1  # Mock dispatch; no model or external service.
        self.reply(200, {"mock": True, "dispatches": dispatches})

    def log_message(self, *_):
        pass  # Never log Authorization headers.

HTTPServer(("127.0.0.1", 8765), Gate).serve_forever()

Run the server in one terminal. In another, send these four requests, in order. The fixture ignores request bodies; no prompt or payload is needed.

python3 local_gate.py
# In a second terminal:
curl -i -X POST http://127.0.0.1:8765/demo/infer
curl -i -X POST http://127.0.0.1:8765/demo/infer -H 'Authorization: Bearer local-demo-only'
curl -i -X POST http://127.0.0.1:8765/demo/infer -H 'Authorization: Bearer local-demo-only'
curl -i -X POST http://127.0.0.1:8765/demo/infer -H 'Authorization: Bearer local-demo-only'

The expected statuses are 401, 200, 200, and 429. The accepted responses should show dispatch counts of one and two. This is a specified expected result, not a claim that the example has been tested against a production service. The sample deliberately omits TLS, multiple users, concurrency, persistent counters, streaming, and request validation; it should never be exposed publicly.

For a real gateway, repeat the negative tests with no credential, a malformed credential, a revoked credential, a valid credential for the wrong project, and an exhausted test allowance. Compare ingress decisions with mock dispatch records using a request identifier. A successful result is both a rejection at the boundary and the absence of an upstream dispatch for that rejected request.

Test alternate routes through your documented service inventory rather than discovering them by broad scanning. Check whether the backend can be reached directly from an untrusted test network, whether a second hostname bypasses policy, and whether management routes enforce their own permissions. A passing test on one route applies to that route and configuration; it is not evidence that every deployment is protected.

Spending alerts and spending enforcement answer different questions

OWASP’s Unbounded Consumption guidance connects uncontrolled inference with service degradation and financial loss, and recommends controls including quotas, rate limiting, timeouts, and monitoring. Operationally, a notification tells an owner that consumption crossed a threshold. Enforcement decides whether the next operation is allowed to start.

Define the unit being controlled. Requests per minute is useful for bursts, but a short request can trigger a long generation, retries, or a tool loop. Token allowances, model restrictions, maximum output sizes, concurrency limits, and total task limits protect different dimensions. No single counter captures all of them.

For a gateway you control, reserve an estimated allowance before dispatch and reconcile it against measured usage afterward. Document how concurrent reservations behave and how abandoned streams release or settle them. Otherwise, several requests may all observe the same remaining allowance and collectively exceed it. This is an architectural recommendation, not a description of an undocumented feature in a particular gateway.

Decide explicitly what happens when accounting is unavailable. Failing open preserves availability while accepting additional financial exposure; failing closed protects the allowance while interrupting legitimate work. A bounded emergency allowance can be a deliberate compromise if it has an owner, expiry, audit trail, and tested maximum exposure. An accidental bypass during a database outage is not such a policy.

Detect misuse without collecting everyone’s prompts

Start with metadata that can answer who consumed what, through which route, and under which decision. A useful event includes a UTC timestamp, request identifier, credential fingerprint or internal key identifier, project, model, policy decision, upstream dispatch status, token usage when available, and a cost estimate with its pricing version. Never log the bearer token itself.

Correlate these events with provider usage records. Gateway logs alone miss direct use of an upstream key; provider totals alone may not identify the application caller. A discrepancy is an investigation lead, not automatic proof of theft: batch jobs, delayed accounting, shared credentials, and pricing changes can also explain it.

Set alert thresholds against an understood workload rather than adopting an arbitrary universal number. A new development project and an established batch-processing service need different baselines. Keep raw prompts out of routine alerts; when content is necessary for an investigation, apply a defined access policy, retention period, and redaction process.

If access has already been abused

Contain the smallest relevant identity and exposure path while preserving an investigation timeline. Revoke a suspected key, stop anonymous access, suspend the affected project when necessary, and record when each change became effective. If the same key is shared across services, identify the legitimate callers before issuing replacements so recovery does not silently recreate the same shared-secret problem.

Then establish the exposure window and the usable permissions. A model-invocation credential does not automatically imply access to training data, provider model weights, application files, or every cloud service. Conversely, a stolen cloud identity may have permissions beyond inference. Determine the actual scope from identity policies and activity records rather than inferring it from the term LLMjacking.

For tool-enabled systems, inspect the execution plane separately. Determine which tool credentials were available, whether sensitive actions required approval, and whether the runner could reach internal services or write persistent files. Replacing a model key does not terminate an already-running task or invalidate a separate database credential. Recovery must follow the identities and processes that were actually exposed.

Reopen access only after the relevant negative tests pass and the replacement identity has a narrower, documented purpose. Save a sanitized evidence bundle: affected service, route, configuration revision, test identity, expected decision, observed decision, dispatch evidence, and any remaining blind spots. A screenshot of a refusal is not a substitute for that record.

What to require from an authorized assessment

Ask for evidence of the boundary being tested. An assessment should identify its permitted targets, caller identities, upstream billing limits, allowed actions, and stop conditions before sending traffic. Findings should include a minimal reproduction, a reason the observed behavior violates the intended policy, and a retest that demonstrates the correction. Broad claims about an agent’s intelligence are less useful than knowing which request was denied and whether it reached the backend.

When evaluating an automated assessment workflow, use a mock upstream first and check the evidence it retains. The demonstration below provides product context; it is not evidence of a Skynet-specific detector, a benchmark against this campaign, or a replacement for provider-side incident investigation.

Questions developers ask about LLMjacking

Is LLMjacking the same as a jailbreak?

No. LLMjacking concerns unauthorized use of model resources or credentials. A jailbreak attempts to change a model’s behavior. They can appear in the same operation, but access control must work regardless of what the prompt says.

Does self-hosting eliminate the financial risk?

No. Self-hosting changes the cost model. Unauthorized usage can consume GPU time, affect other workloads, and trigger infrastructure costs even without a per-token provider invoice. Evaluate availability and capacity as well as direct charges.

Is every exposed model endpoint an RCE vulnerability?

No. Inference access alone does not establish code execution. RCE requires an additional mechanism or an application that grants execution authority. Inspect the tool runner and management surface separately.

Will rotating a key solve the whole incident?

It stops future use of that key once revocation takes effect. It does not close an anonymous endpoint, revoke unrelated identities, terminate running jobs, or remove credentials stolen through another path. Verify each relevant boundary.

How can I check safely without scanning the internet?

Use your owned service inventory, a staging environment, and a mock upstream. Test known routes with missing, invalid, revoked, and out-of-scope credentials, then verify that rejected requests did not dispatch inference.

Did the Skynet report demonstrate 100,000 successful attack steps?

No. That number was an instruction in the captured request. The reported honeypot did not execute the tool calls. Keep the operator’s intended behavior separate from the researchers’ observed results.

The strongest evidence of protection is a reproducible decision at the resource boundary: an unauthorized caller is rejected, no inference is dispatched, and the accounting and execution records agree. That is the result to establish before trusting a public model endpoint.