Access to AI models costs money, and some attackers prefer someone else to pay. A September 26 Financial Times report addresses account and server theft for AI activity. Earlier research from Google's threat intelligence team describes the technical basis: stealing access credentials and exploiting organizational infrastructure to run computing workloads without authorization.
The phenomenon is sometimes called LLM-jacking. It is not limited to hijacking a chatbot conversation: an API key or cloud permission may allow use of a paid quota and sometimes computing resources the organization never intended to operate for that party.
An account is only one entry route
Google's report, published earlier in September, describes demand for AI service credentials and attempts to steal development tool configuration files. Such files may contain keys or service addresses used by coding assistants.
According to the researchers, attackers seek more than a user's browser password. They are also interested in how the work tool connects to the model, which account is billed and which permissions it has been given.
Distinguish the two publication dates: the Financial Times article is the new report; Google's research is the background source for the technical description. Do not present all the older research findings as though first revealed over the weekend.
Unauthorized use can look like ordinary work
For the account owner, the first sign may be an exhausted quota, an unusual charge or activity they did not initiate. Such a charge alone does not prove a breach, but warrants examining usage history and active access credentials.
A valid API key lets software authenticate with a service. If exposed, changing the login password alone does not necessarily revoke it. The key itself and its associated permissions need checking.
What to check in an organization
Separate keys between systems, give each only necessary permissions and set usage and budget alerts where the service allows. Revoke and replace an exposed key, rather than merely removing it from the document where it appeared.
Extend the check to code repositories and development environments too. As AI becomes part of work tools, its credentials become an asset to manage like any other organizational secret. Protection begins with identifying who can use the resource, not only who may open the chat interface.