Attackers are hijacking company AI, using stolen access to run up bills

Hackers are hijacking corporate AI access to run up usage costs. In one case, nearly 200,000 API requests were made in just two minutes, CrowdStrike's 2026 Threat Hunting Report finds

As companies increasingly use generative artificial intelligence (AI) for everything from coding to customer support, cyber attackers are finding another way to make money from compromised systems. Instead of stealing data or encrypting files for ransom, they can simply use a company’s AI services and leave the company to pay the bill.

 

CrowdStrike’s 2026 Threat Hunting Report has identified the growing use of two related techniques, LLMJacking and Cost Harvesting. In both cases, attackers exploit access to corporate AI infrastructure. The difference is in what they do with that access.

What is LLMJacking

LLMJacking involves taking over a company’s access to large language models (LLMs) and using it for the attacker’s own purposes. Cost Harvesting goes a step further, deliberately generating enough AI activity to increase the victim’s bill and cause financial damage.

 

The report, which analysed activity observed between July 2025 and June 2026, found that AI-enabled adversary activity surged 89 per cent in 2025. It also found that AI Model Access techniques accounted for 16 per cent of all MITRE ATLAS techniques observed during the past year.

 

ATLAS, or the Adversarial Threat Landscape for AI Systems, is a framework maintained by MITRE that maps the tactics and techniques attackers use against AI-enabled systems. It is similar in concept to MITRE ATT&CK, but focuses specifically on threats involving AI systems. The framework is based on real-world attack observations as well as demonstrations from AI red teams and security researchers.

When the AI bill becomes the target

The shift matters because AI services are increasingly tied directly to corporate cloud 

accounts. Companies pay cloud and AI providers based on the amount of computing or model usage, meaning a compromised account can become a source of financial loss even if no sensitive information is stolen.

 

CrowdStrike calls Cost Harvesting an impact technique in which attackers deliberately push a victim’s AI services beyond normal usage to increase costs and cause financial harm. The report identifies it as the most common MITRE ATLAS Impact technique observed over the past year.

This is similar to cloud resource hijacking, where attackers use compromised cloud accounts to run cryptocurrency mining or other computing workloads on someone else’s infrastructure. CrowdStrike said cloud-conscious eCrime activity increased 171 per cent during the reporting period, with attackers targeting cloud environments for credential theft, cryptomining and LLM abuse.

 

The difference is that AI services offer a relatively direct route to monetisation. An attacker does not necessarily need to steal and sell corporate data. Access to a company’s paid AI capacity can itself have value.

Nearly 200,000 requests in two minutes

CrowdStrike’s LLMJacking case study shows how quickly this can happen.

 

In May 2026, a financially motivated threat actor gained access to a cloud identity with a long-term access key and targeted a cloud service offering access to foundation AI models.

 

The attacker first checked the compromised account and tested what permissions it had. After initially being blocked from accessing the AI models, the attacker obtained temporary credentials, elevated permissions and used the cloud administrative console to complete the requirements needed for model access.

 

Once access was established, the attacker began making calls to the AI models at scale.

 

During an initial two-minute burst, nearly 200,000 API requests were sent before throttling limited further activity. CrowdStrike said many of these appeared to be requests from customers being routed through the compromised account. They varied in input and output sizes and involved multiple models and regions. The attacker also sent small health-check requests to monitor whether the service was available.

 

For the victim, the problem is not simply that an account was compromised. Every successful AI request can represent usage that the company may ultimately have to pay for.

 

The report does not provide a final bill for this particular incident. But the episode illustrates how a stolen cloud identity can turn AI access into a financial resource for attackers.

Why this is different from data theft

Traditional cyberattacks often have an obvious target. Attackers steal customer information, intellectual property, credentials or financial assets. Ransomware groups encrypt files and demand payment to restore access.

 

LLMJacking changes the equation.

 

The attacker may have little interest in the company’s data. Instead, the value lies in the company’s existing relationship with an AI provider.

 

A compromised API key, cloud identity or access token can provide access to models that would otherwise cost the attacker money to use. The attacker can then use that access for its own AI workloads or potentially route other users’ requests through the compromised account.

 

This makes AI access a monetisable cyber asset in its own right.

 

The CrowdStrike report says AI Model Access techniques made up 16 per cent of the MITRE ATLAS techniques observed during the past year. It also says Impact techniques accounted for 8 per cent, with Cost Harvesting the most common technique within that category.

The problem is visibility

One reason these attacks can be difficult to spot is that the individual actions may look legitimate.

 

An API request to an AI model is not inherently suspicious. Neither is a cloud login or a request made using a valid access token. The warning signs can instead emerge from the pattern of activity: a sudden increase in requests, unusual models being accessed, unfamiliar regions, changes in usage patterns or activity outside normal business hours.

 

CrowdStrike makes a similar point about cloud resource hijacking. It said individual API calls can appear legitimate when viewed separately, while the combination of their speed, frequency and context reveals malicious activity.

 

That creates a problem for companies that closely monitor traditional security events but treat AI usage mainly as an IT or finance issue.

AI is becoming both a tool and a target

The broader trend in CrowdStrike’s report suggests that this is not an isolated problem.

 

The company said AI is now being used by attackers to accelerate phishing, reconnaissance and technical operations, while AI systems inside companies are themselves becoming targets.

 

That creates a double-edged situation for businesses. AI can help employees and developers work faster, but every new connection to an AI service also creates another identity, credential, API key or cloud permission that needs to be protected.

 

For security teams, the question is therefore no longer limited to whether an attacker can get into an AI system or steal information from it. It is also whether the attacker can quietly turn that access into a bill.