Google researchers warn of rising AI ‘LLM-jacking’ and dark web markets

LLM-jacking cybercrime dark web artificial intelligence computing power theft

Cybercriminals are increasingly engaging in a practice known as ‘LLM-jacking,’ which involves the illegal acquisition of artificial intelligence models and computing power. According to researchers from the Google Threat Intelligence Group, there has been a sharp rise in these activities this year.

On dark web marketplaces, unauthorized access to advanced AI models from companies such as OpenAI, Google, and Anthropic is being sold at discounts of up to 97%. To circumvent detection by AI labs, some sellers offer ‘guaranteed access,’ promising to provide new credentials if an account is banned.

Beyond stealing subscriptions, hackers are also infiltrating corporate cloud servers to install their own AI models, effectively hijacking the victim's computing resources to run them for free. This provides attackers with a significant economic and efficiency advantage, as they can acquire expensive AI tokens at a fraction of the cost while defenders must pay full price to maintain their security infrastructure.

Entities

Anthropic · Claude · Google Threat Intelligence Group · John Hultquist · OpenAI

Claims

What the coverage asserts, and how many sources carry each claim.

[● 4 SOURCES] Low-cost access to AI tokens provides attackers with an economic and efficiency advantage over defenders. www.in.gr · www.ot.gr · www.ithome.com · www.newsbytesapp.com
[○ 1 SOURCE] Anthropic identified threat actors attempting to use Claude for malicious purposes in more than 24 countries. www.newsbytesapp.com
[● 4 SOURCES] Dark web marketplaces are selling unauthorized access to AI models from OpenAI, Google, and Anthropic at discounts of up to 97%. www.in.gr · www.ot.gr · www.ithome.com · www.newsbytesapp.com
[● 4 SOURCES] There has been a significant increase in LLM-jacking activities this year. www.in.gr · www.ot.gr · www.ithome.com · www.newsbytesapp.com
[● 4 SOURCES] Hackers are breaking into corporate cloud servers to install and run their own AI models using stolen computing resources. www.in.gr · www.ot.gr · www.ithome.com · www.newsbytesapp.com