LLMjacking

LLMjacking is the theft of AI inference capacity: compromising cloud credentials, API keys, or exposed self-hosted model servers to run inference at the victim’s expense. The term was coined by Sysdig’s Threat Research Team in May 2024. By 2026 the stolen capacity is also used as reasoning infrastructure for automated attacks, not only resold.

Two things changed the shape of the technique. The targets widened from cloud provider keys to self-hosted engines: exposed Ollama, LM Studio, and LangServe instances, and the gateway libraries that aggregate many providers' credentials. And the use changed from resale to offense: Sysdig's June 2026 finding documented stolen compute wired into a multi-stage attack pipeline that scans and exploits targets without a human in the loop. Sysdig counted about 175,000 publicly reachable Ollama instances at the time (Cloud Security Alliance research note). For a deployer, an exposed local model is therefore a liability beyond the data on the box: it is someone else's attack engine. The first half of self-hosted LLM security is keeping it private; the second half is governing the agent behind it.

Related

• Self-hosted LLM security
• Local models docs
• All glossary terms