LLMjacking

Overview

LLMjacking is a documented 2024-onward attack class in which adversaries hijack access to third-party LLM APIs — typically through credential theft or prompt-level manipulation — and resell or weaponise that compute on underground markets. The term was introduced by Sysdig in 2024; Pillar Security’s “Bizarre Bazaar” research, Kaspersky’s April 2026 Raspberry Pi private-AI honeypot, and the Cloud Security Alliance’s documented resale marketplace covering 30+ LLM providers have built out the literature since.

Timeline

• 2026-10-23-AI-Digest — Symantec published a honeypot study capturing a prompt-based LLMjacking attack with five stacked instruction layers. The fifth layer carries a payload of 74 modules in total (scanning, framework exploits, database dumping, botnet components) and is designed to run the hijacked model for up to 100,000 steps with no human in the loop. The honeypot captured the prompt and a secondary script but did not execute the bundled tooling — attack-design intelligence, not an in-the-wild incident report. Reframe worth carrying: this adds depth to a known pattern (sustained autonomous operation) rather than opening a new attack vector. Avoid “novel” framing; prefer “notable autonomy-horizon growth of a documented pattern.”

Key Developments

1. Documented 2024-Onward Attack Class: Sysdig’s 2024 work introduced the term; Pillar Security’s “Bizarre Bazaar” logged ~35,000 sessions over 40 days; Kaspersky ran a Raspberry Pi private-AI honeypot in April 2026; the Cloud Security Alliance documents a resale marketplace covering 30+ LLM providers.
2. 100,000-Step Autonomy Horizon (October 23, 2026): Symantec’s five-layer / 74-module honeypot capture is notable for the autonomy-horizon depth rather than the attack class itself — the attack is designed to sustain 100,000 autonomous steps with no human in the loop.