Hackers are increasingly targeting AI platforms through a practice known as LLMjacking, which involves stealing API keys and session tokens to exploit corporate compute budgets. These credentials are sold on underground markets at discounts ranging from 40% to 60% compared to retail prices.
Data from the 2026 CrowdStrike Threat Hunting Report indicates an 89% rise in AI-related cyber threats between July 2025 and June 2026. Furthermore, Google Threat Intelligence reports that the average cost of stolen AI accounts has more than doubled throughout 2026.
In September 2026, Okta security researchers identified hundreds of active tokens for AI services within a 7 GB log dump. During the same month, autonomous AI-agent campaigns successfully compromised infrastructure across 395 organizations in 48 countries.
Attackers currently resell access to over 30 different large language model providers. While some incidents involve massive bursts of activity, such as 200,000 API requests in two minutes, sophisticated actors often throttle usage to evade detection systems.
