Token Jacking: Cybercriminals Could Be Stealing Your AI Resources

This Unit 42 article explores a threat called 'Token Jacking,' where cybercriminals steal developer API keys for AI services to illegally access and resell AI compute resources. Attackers target exposed or poorly secured API tokens to fuel gray market transfer stations, effectively piggybacking on legitimate users' AI subscriptions and quotas. The theft allows bad actors to use expensive AI inference resources at the victim's expense. This type of attack is particularly relevant as AI API usage grows rapidly among developers and enterprises. The financial and operational impact can be significant, as victims may face unexpected billing charges and degraded service. Organizations are advised to secure their AI API keys and monitor usage for anomalies.