Leadership1 publisher2 min readPublished
Sysdig found a credential-theft crew reselling access to a victim's hosted Claude
The Sysdig Threat Research Team says stolen cloud keys were checked against ten hosted model services and fronted to buyers, with the compromised tenant paying for every prompt at invocation prices.
The Board Room · Leadership desk
What happened
- The Sysdig Threat Research Team documented an attack it calls LLMjacking, in which stolen cloud credentials were used to reach ten cloud-hosted large language model services.
- The credentials came from a system running a version of Laravel vulnerable to CVE-2021-3129, which the attackers used to get into the cloud environment.
- Sysdig says an attack of this kind, if it goes undiscovered, could produce more than $46,000 of LLM consumption cost per day for the victim.
- No legitimate queries were run during the verification phase; the attackers did just enough to learn what each credential could do and what quotas applied to it.
- A user-agent matching the open source OAI Reverse Proxy was seen attempting to use LLM models with the compromised credentials.
Compiled by The Board RoomSomething wrong?How this is made
Why it matters
- cost The tenant that owns the credentials pays for prompts run by strangers, so the loss accrues every day the account stays open and stops only when someone reconciles the spend or rotates the key.
- exposure The attackers read logging configuration where they could. The victim's own detection setup sits inside the target surface before the first prompt is billed.
- decision Someone has to own the alert on abnormal model-invocation spend this quarter; if it sits in a monthly finance review, detection latency is a month of charges at the rate Sysdig describes.
- precedent A working proxy layer makes a pool of stolen keys sellable without exposing them. Leaked cloud credentials now have a buyer even when the tenant holds nothing else worth taking.
Sysdig's own framing is that attacks on LLM systems have mostly been discussed as prompt abuse and altering training data [15]. This case is a billing attack. A tenant whose keys sit in someone else's proxy pool pays for every prompt the buyers run. Seven days at Sysdig's daily figure is $322,000; thirty days is about $1.38m [1]. Sysdig gives that number as a potential result if the attack goes undiscovered and does not publish the token volumes or prices behind it, so it describes one modeled tenant [16].
The model actually targeted was a local Claude v2/v3 instance from Anthropic, hosted for the victim by its cloud provider [5]. The credential-checking script was wider than that. It tested keys against AI21 Labs, Anthropic, AWS Bedrock, Azure, ElevenLabs, MakerSuite, Mistral, OpenAI, OpenRouter and GCP Vertex AI [3].
Hosted models are not switched on by default. Access needs a request to the cloud vendor, approved automatically for some models and behind a short form for others, and usually granted quickly [13]. Sysdig's researchers wrote that the requirement "is often more of a speed bump for attackers rather than a blocker, and shouldn't be considered a security mechanism" [12].
The credentials left through a known vulnerability in an internet-facing application [2]. That is the patching half of the story. The second half starts once the keys are in a resale pool: the earliest signal inside the victim's own environment is invocation volume and spend, and those numbers get read on whatever cadence the tenant reconciles billing.
Sysdig also offered a second possible motive, extracting LLM training data [9]. Rotation does different work in each case. If resale is the point, rotating the credential stops the loss at the rotation. If extraction is the point, rotation stops the billing and not the copying. Per-model quotas cap the daily maximum in both cases, and they also cap the team that wants headroom for a launch. In one OAI Reverse Proxy instance Sysdig found running on the internet, with no evidence tying it to this attack, the display showed token counts, costs, and the keys [14].
What to watch
- Whether any victim or vendor publishes an actual observed bill, instead of a modeled daily maximum, for a hijacked model tenant.
- Whether cloud providers ship spend-velocity alerting or default per-model quotas for newly enabled hosted models.
- Whether credential-checking kits start enumerating model quotas and logging configuration as standard, as Sysdig saw here.