LLMjacking: How Attackers Are Hijacking Exposed AI Models at Your Expense

Researchers at Symantec have documented a new attack technique known as LLMjacking, in which automated agents scan the internet for publicly accessible AI models and then use them to plan and execute cyberattacks — with the computing costs charged to the model's owner, according to Help Net Security. Symantec captured the attacker's full instruction set over the summer via a honeypot configured to appear as an unprotected AI service. The technique involves an agent that identifies exposed large language model endpoints, then uses them as a reconnaissance and planning tool for further intrusions. Because cloud-hosted AI inference is billed per token, victims can face significant unexpected costs in addition to the security risk.

Why this matters for UK organisations

As UK organisations increasingly adopt AI capabilities — through cloud APIs, self-hosted models, or third-party integrations — the attack surface associated with those deployments is growing in ways that security teams may not yet have fully mapped. Development teams building AI-powered applications often move quickly, and access controls and monitoring for AI endpoints may not receive the same scrutiny as more traditional infrastructure. An exposed model endpoint is not simply a data risk: it is a resource that attackers can exploit for their own purposes while the legitimate owner absorbs both the financial cost and any reputational consequences if the model is used to facilitate attacks on others. The financial dimension is particularly worth noting — unexpected AI inference costs can be a useful early indicator of unauthorised use, but only if spend monitoring is in place.

What to review

Organisations should audit any AI model endpoints they have deployed or integrated to confirm that none are publicly accessible without authentication. This includes self-hosted models, cloud API gateways, and any AI services exposed through internal developer tooling. Usage monitoring and cost alerts should be configured on all cloud-hosted AI services so that unexpected activity is flagged promptly. Security and development teams should work together to apply consistent access control principles to AI infrastructure — the same standards that apply to any other sensitive system. Where AI capabilities are being built into products or services, a brief security review of the deployment architecture is a sensible step before those services go live.

Source: Help Net Security