Your customers' leaked keys end up in resale pools, and the traffic arrives under accounts you have every reason to trust. A platform can find many leaks first, notice when a key changes hands and cap what a stolen key can spend.
An AI platform stops API key abuse by finding leaked keys before attackers do, prompting rotation, watching for keys that change hands and capping what any key can spend. LLMjacking becomes an inference cost the platform can contain. Some platforms already block leaked keys on their own. Google's Gemini API, for example, answers a blocked key with the error "Your API key was reported as leaked. Please use another API key." This guide is for the platform that issues the keys. A short section near the end covers what a developer with a leaked key should do.
A stolen key matters to the platform as well as to the customer who leaked it. Anthropic reported in September 2026 that "Fraudulent resellers have increasingly been supplied by compromised access", mostly keys and session tokens that customers exposed by accident. Those resellers sell your tokens on API relays, and the traffic reaches you on a paying customer's account. Our guide to token fraud sets stolen keys alongside the other sources of resold tokens.
At a glance
GitGuardian counted 1,275,105 credentials for AI services among the secrets exposed in public GitHub commits in 2025, up 81% on 2024.
GitHub's secret scanning partner program reports leaked keys straight to the provider that issued them. On 19 October 2026 its list covered keys from Anthropic, OpenAI, Groq, OpenRouter, xAI and Hugging Face, but not keys from Cohere, DeepSeek, Mistral AI or Perplexity.
Anthropic said in September 2026 that resellers are increasingly supplied by keys and session tokens that customers leaked.
When Permiso planted a cloud key in a GitHub file in 2024, attackers tried it within minutes.
AWS's quarantine policy for exposed credentials blocks Amazon Bedrock model calls, and its GuardDuty AI Protection flags model calls from an unusual IP address for that identity.
What is LLMjacking?
LLMjacking is the use of stolen credentials to run AI models at someone else's expense. Sysdig's threat research team named it in 2024, and the attacker either uses the access or resells it.
Sysdig's definition calls it "an attacker using stolen credentials to gain access to a victim's large language model (LLM)." Its first report, in May 2024, found attackers checking stolen cloud keys for model access and a reverse proxy set up to sell that access on.
Anthropic's September report says stolen AI credentials give an attacker three things: resale value, compute "at someone else's expense", and cover. On cover, it writes that "The activity is attributed to the credential's legitimate owner." That third point is the platform's problem. The account passed sign-up long ago and pays by card, so your sign-up checks have nothing to flag.
How many AI keys leak?
More every year, and many stay valid long after they leak. GitGuardian found more than 1.2 million AI-service credentials in public GitHub commits in 2025 alone.
GitGuardian's State of Secrets Sprawl 2026 counted 28,649,024 new secrets in public GitHub commits in 2025. Of those, 1,275,105 were credentials for AI services, up 81% on the year before. "Credentials for AI services are accelerating faster than any other category," the report says. Leaks also last. Of the valid secrets GitGuardian found in 2022, it says that "Four years later, 64% are still active and exploitable". GitGuardian sells secret detection, so these are a vendor's figures, and not every detected secret works.
Public code is only the visible part. Anthropic lists "GitHub, mobile application install files, Docker containers, websites, and chatbots" as places customers expose keys. It describes one project that downloads every APK file from the Google Play Store and searches them for session tokens and other access.
What happens to a leaked key?
A leaked key passes through a short chain of hands, from the scanner that finds it to the reseller that sells its tokens. No source follows one key through every stage, so the table joins several.
Stage
What happens
Source
1. Exposure
A key lands in public code, an app build, a container, a website or a chatbot
Anthropic 2026; GitGuardian 2026
2. Discovery
Attackers scan those places. Permiso's planted key drew attempts within minutes
Permiso 2024
3. Validation
The attacker checks which models the key reaches, without running real prompts
Sysdig 2024
4. Sale
Brokers sell working keys. One seller offered OpenAI keys with $18 of credit for $1.50 each
Anthropic 2026; Halcyon 2026
5. Pooling
Resellers put stolen keys behind their own endpoint and rotate in new ones
Anthropic 2026
6. Resale
Buyers pay a discount for what looks like an ordinary API
Pillar 2026; Microsoft 2025
7. The bill
The key's owner pays list price. One leaked test key served 100 million tokens
UC Santa Barbara preprint 2026
8. Shutdown
A secret scanning report reaches the platform, the platform or owner revokes the key, or the owner sees the bill
GitHub, Anthropic, Google and AWS documentation
Permiso measured discovery in 2024. Its researchers placed a cloud key in a file on GitHub and saw attempts against the exposed key within minutes. Sysdig's first report says no legitimate LLM queries were run during the verification phase.
Brokers then sell the working keys. Halcyon found one seller offering OpenAI keys loaded with $18 of credit for $1.50 each. In February 2025 Microsoft's Digital Crimes Unit described Storm-2139, whose members "exploited exposed customer credentials scraped from public sources" and then "resold access to other malicious actors".
Why is a stolen key hard for a platform to see?
A stolen key runs on a real customer's account, with a real card and a clean sign-up history. Attackers also take care to make their traffic look like the owner's.
Anthropic describes one actor whose scanner found exposed keys in public containers and then rotated their use "across a local proxy layer". That, Anthropic writes, let the actor "blend their traffic in with the traffic from the legitimate owner of the stolen API keys." Another actor ran sites offering discounted AI access whose client apps stole keys and session tokens from victims' devices. When a victim reset a compromised key, the malware sent the new one too.
Researchers led by UC Santa Barbara saw the same problem from the provider's side. In an April 2026 preprint, not yet peer-reviewed, they leaked one of their own OpenAI keys in places relay operators frequent. "That single key served 100M GPT-5.4 tokens and exposed more than seven Codex user sessions." In at least one session, several distinct credentials appeared behind the leaked key, and the authors write that "We cannot always distinguish among those paths from provider-side logs alone."
How do stolen keys reach API relays?
Brokers sell stolen keys to resellers, who pool them and sell the tokens as a discounted API. Anthropic says those networks keep swapping in fresh keys as old ones run dry.
In Anthropic's words, brokers "often feed into fraudulent AI reseller networks that rotate in new stolen API keys and session tokens until they exhaust their usage." Sysdig wrote in June 2026 that by 2025 "LLMjacking matured into an industrialized black market". Pillar Security traced one operation to a marketplace reselling access to more than 30 LLM providers, which it said "resells access at 40-60% discounts while you pay full retail for unauthorized usage."
From the platform's side, one leaked key can serve many of a relay's customers until its usage runs out. The API relays guide covers what those relays look like and what they charge.
What does a leaked key cost, and who pays?
The key's owner pays first, at list price, until someone notices. Public figures come from single experiments, so nobody knows the total.
One key, 100 million tokens. The UC Santa Barbara team's leaked key served 100 million GPT-5.4 tokens. The paper gives no dollar figure.
One key, 75,000 requests in two days. Attackers tried Permiso's planted key within minutes, but the heavy use came later. Permiso writes that "Over the course of two (2) days we saw over 75,000 successful model invocations". Permiso says AWS blocked the key about 42 days after its first malicious use.
A modelled worst case. Sysdig estimated in 2024 that a stolen cloud AI credential could cost its owner up to $46,000 a day. It is a model built on 2024 prices, not an observed loss.
The platform pays too, because its compute serves a relay's customers instead of its own.
How can a platform find its customers' leaked keys first?
Join GitHub's secret scanning partner program, give your keys a format that a pattern can match and revoke on report. Some platforms also block keys that are unrestricted or long unused.
GitHub's partner program lets a service provider register its key formats. When GitHub finds a match "in a public source, a payload is sent to an HTTP endpoint of your choice", and it advises partners to treat every reported secret as "public and compromised". The steps include creating regular expressions for your keys and building revocation and user notification into your alert service.
Coverage among AI platforms is uneven. GitHub's supported patterns list shows partner alerts for API keys from Anthropic, OpenAI, Groq, OpenRouter, Replicate, xAI and Hugging Face on 19 October 2026. Cohere, DeepSeek, Mistral AI and Perplexity keys appear only for alerts to repository owners, so GitHub does not tell those providers about a public leak.
Partners act on the reports. Anthropic's key guidance says that "Anthropic automatically deactivates the exposed API key" and that the customer "receives a detailed email notification from Anthropic about the incident." Google's Gemini documentation promises "fast-acting leaked key enforcement that quickly stops the usage of leaked keys detected by our systems", and Gemini developers have reported the resulting error in Google's developer community since November 2025. Google also says the Gemini API rejects unrestricted standard keys, and since 7 May 2026 it blocks unrestricted keys that have sat unused for an extended period.
When should a platform prompt customers to rotate keys?
Prompt at creation, by setting an expiry, and again whenever a key's use changes. Shorter-lived credentials leave a stolen key less time to sell.
OpenAI's production guidance says "We strongly recommend setting an expiration date when you create a project API key." Anthropic suggests rotating keys "every 90 days" as an example. Okta, which sells identity products, goes further and argues that "Static API keys are the currency of the gray market". Its August 2026 report says "Providers should issue no credential with an indefinite lifetime".
Revocation needs an intermediate step for keys that may be compromised but are still in use. AWS shows one model. When an IAM user's credentials are exposed, it attaches a quarantine policy that denies a list of costly actions, bedrock:InvokeModel among them, "while not impacting the existing resources". The customer keeps their account and data, and the stolen key stops running models.
Rotation alone has a limit. If malware sits on the customer's machine, it steals the new key too, as Anthropic's case shows. Pair each forced rotation with a note telling the customer where the old key leaked, when you know.
How do you spot a key that is suddenly used from new networks?
Learn where and how each key is normally used, then flag a key whose networks, clients, models and hours all change at once. A single change proves little, but a stolen key usually changes several together.
Cloud platforms already do this for their own AI services. AWS's GuardDuty AI Protection, an AWS product, flags model calls "that deviate from the established baseline for an identity or account, such as invocations from an unusual IP address, an unusual API, or an unusual model." It also flags cost harvesting, where an attacker sends expensive inputs to run up the owner's bill. The US advisory from CISA, the NSA and the FBI lists "shared accounts from multiple IPs/user agents" among its warning signs.
Networks are only one part. The Anthropic actor above routed stolen keys through a proxy to look like the owner, so check the client software, models, languages and hours of use alongside the network. A key that served one company's office hours and suddenly runs around the clock, in new languages and from hosting providers, is probably no longer serving that company. When that happens, alert the customer, cut the key's limits and revoke it if the customer doesn't recognise the use.
Why do spend caps limit the damage?
A reseller drains a stolen key until it stops working, and a cap decides when that happens. Platforms that let customers set hard limits, and set sensible defaults for them, cap the loss on every stolen key.
OpenAI says "Hard spend limits stop affected API traffic when tracked spend reaches the limit," and lets customers "set custom rate and spend limits per project." Anthropic says its spend limits are "a safeguard against unexpected usage due to leaked keys or errant scripts." Google's Gemini guidance offers billing alerts, which warn without stopping traffic.
Anthropic's phrase about reseller networks explains why caps work. Those networks rotate keys "until they exhaust their usage". A key with a low cap is worth less to a reseller and costs your customer less. Per-key limits, below the account's total, also stop one leaked key from spending the whole account's budget.
Stolen keys are the source of resold tokens that platforms see least
Fraudulent accounts at least have to pass sign-up. A stolen key skips it, so every control built around new accounts misses it.
The public record shows the gap. The labs count fraudulent accounts in the thousands in their own reports, but for stolen keys the evidence is Microsoft's Storm-2139 case, a few planted keys and Anthropic's word "increasingly". The loss figures are all single experiments or single models, and both experiments were set up to attract attackers. They prove that a leaked key gets used, and say nothing about how often.
We think most stolen-key supply comes from small apps that ship keys inside their builds, which have no security team and notice the leak only when the bill arrives. That is our expectation, not a measurement, though the Anthropic APK case and GitGuardian's growth figures fit it.
If you are a developer with a leaked key
Revoke the key now, create a new one and check your bill. The Gemini error "Your API key was reported as leaked" means Google has already blocked the key, so replace it rather than trying to revive it.
Revoke and replace. Anthropic recommends "revoking the key immediately". Google's guidance is to create the replacement first, then disable the leaked key.
Clean up. Remove the key from code, history, containers and app builds. Treat any key that reached a public commit as compromised, even after you delete it.
Check usage and billing. Look for models, hours and volumes you don't recognise.
Set limits. Use a spend limit, per-project limits and key restrictions where your provider offers them.
Keep keys out of clients. Never ship a key inside a web or mobile app. Call the model from your own server.
What to check on your platform
These checks use your own key, billing and usage data.
Your key format. Check that your keys have a distinctive prefix a regular expression can match, and that you are in GitHub's secret scanning partner program.
Your response time. Measure the time from a leak report to revocation, and whether the customer hears from you before they see the bill.
Keys without an expiry. Count active keys with no expiry date and keys unused for 90 days or more.
Spend caps. Find out what share of customers have a hard limit, and whether new keys get a default.
Keys that change networks. List keys whose traffic moved to new hosting providers or countries in the last month, with a change in models or hours.
Keys that served many clients. Find keys sending traffic with many client types or session patterns at once.
Your keys for sale. Search relay storefronts for your model names, and compare their prices with the keys you have flagged.
Where NoResponse fits
Usage fingerprints learn how each account uses your platform, so an account whose key has been stolen stands out from its own past when its networks, clients, models and hours change together. They also link accounts that behave alike, so the keys feeding one reseller pool show up as one operation. Fingerprints use account and request-pattern signals in your gateway to identify repeat abuse. NoResponse does not make content-safety decisions.
Relay intelligence covers 70+ relay and resale services and shows which of them sell your tokens, so you can tell when your customers' keys have joined a pool. During a wave of key theft, incident support helps your team revoke the pool's keys together and warn the customers who leaked them.
Book a demo to see which of your customers' keys are running somebody else's traffic.
LLMjacking is the use of stolen credentials to run someone else's AI models at their expense. Sysdig's threat research team named it in 2024. The attacker either uses the access directly or sells it through a reseller that pools stolen keys.
How can an AI platform detect stolen API keys?
It can learn each key's normal networks, clients, models and hours, and flag a key when several change at once. It can also join GitHub's secret scanning partner program, so leaked keys in public code are reported to it directly.
What does "your API key was reported as leaked" mean?
It is the error Google's Gemini API returns after its systems flag a key as leaked and block it. Create a new key, keep it out of public code and client-side apps, add restrictions to it and check your billing for use you didn't make.
Where are stolen AI API keys sold?
Brokers sell them in underground markets, and resellers pool them into services that sell discounted tokens. Halcyon found OpenAI keys with $18 of credit offered for $1.50 each, and Pillar Security traced hijacked access to a marketplace selling it at 40 to 60% off.
Should an AI platform cap customer spending?
Yes, at least by offering hard limits and sensible defaults. A cap ends a stolen key's usefulness to a reseller at a known amount, and OpenAI and Anthropic both offer spend limits for this reason.
