Do You Know What LLMJacking is? You Need To!

To be honest, I had never heard the term before tonight.

It is a variation on stealing your credentials, either your userid and password or your API key.

What is different is what happens after that.

Usually hackers do one of two things after stealing your credentials. They steal your data to sell it or they encrypt your computers (ransomware) and try to extort you.

But LLMJacking is different. Instead, they use your credentials to run large and expensive LLM queries.

Alternatively, once they get the credentials they sell them to someone else who runs very large LLM queries.

Some businesses are getting bills of up to a million dollars. I have heard that Google’s reply to this is that it is your job to protect your credentials and please pay the bill.

Understand that there is really no law that protects you in this case; more than likely you are liable. I heard of one company that got caught up in this that was a start-up. They were forced to close the business and declare bankruptcy.

Most of the large providers allow you to set a limit but all that does is send you an alert if you exceed that limit. It is a soft limit. It does NOT cut the user off. And that assumes that you have even known that is something you can do and set it up. For some of the AI LLM services you can respond but it is up to you. You need to (hopefully) automate the process of seeing the alert and revoking the credentials or API keys.

Bottom line is that if you have AI services that you use that are token based (variable cost) you need to make sure that you understand your liability and understand how you are going to handle it. Getting an alert and forwarding it to some department head won’t save you.

If you need assistance, please contact us.

Credit: Infosecurity Magazine

by