The growth of generative AI has created a new resource criminals can abuse: access to AI models and the computing infrastructure behind them.
The practice often described as LLM-jacking involves stealing credentials or cloud access and using those resources for AI workloads.
The basic security principle is familiar.
If an API key, cloud credential or access token gives someone access to a valuable service, it needs to be protected like a password.
Developers should never commit AI API keys to public repositories or place them in client-side code where users can retrieve them.
Use environment variables or a proper secret-management system. Restrict keys to the permissions and services they actually need. Rotate them when exposure is suspected. Monitor usage for unusual spikes.
The same lesson applies to personal accounts: do not assume that an AI service is too new or too niche to attract attackers.
Anything that provides computing power, money or access can become a target.