Skip to the story
All stories

Hackers Steal AI Accounts in 'LLM-jacking' Surge

Cybercriminals are reselling stolen AI access and cloud resources on the dark web, according to security researchers.

AI-assisted coverage comparison, editor-supervised · How this was made

Published Updated
Hackers Steal AI Accounts in 'LLM-jacking' Surge

What this story says

  • Hackers are increasingly stealing AI accounts and cloud computing resources, a practice called 'LLM-jacking'.
  • These stolen resources are resold on the dark web for up to 97% less than their original cost.
  • Google's Threat Intelligence Group has warned of a surge in these attacks.
  • Cybercriminals use the hijacked resources for automated cybercrime operations, gaining a significant economic advantage.

Who covered it

Left 0%(1)Centre 20%(1)Right 80%(4)

Percentages are shares of the 6 outlets carrying a published leaning rating. 7 of the 13 outlets we know ran this story carry no rating and are not counted in them. Coverage measured .

Trust

42/100

Craft

57/100

Hype

68/100

13 sources · methodology

Cybercriminals are increasingly targeting artificial intelligence accounts and cloud computing resources in a practice known as 'LLM-jacking'. These stolen assets are being resold on the dark web at substantial discounts, with some accounts available for up to 97% less than their typical cost. Google's Threat Intelligence Group, through principal analyst John Hultquist, has issued warnings about the escalating number of these attacks this year. The illicitly obtained AI resources are being used to power automated cybercrime operations and provide attackers with a significant economic edge.

Disagreement on specifics of resale

While multiple reports indicate that stolen AI accounts and cloud resources are being resold on the dark web at significant discounts, the exact figures vary. One report states that accounts costing up to $200 per month are being sold for just a few dollars. Another report specifies discounts of up to 97%.

What the coverage left out

None of the centre or right-rated reports mention the specific figure of $200 per month for AI account costs that was present in one of the unrated reports.

Still developing. We have re-checked which outlets are covering this 8 times, most recently on 27 Sept 2026, 22:15, and will add the sides that appear.

How each side covered it

Our own reading of the reporting listed below, written from the outlets’ articles rather than quoted from them. The reasoning is set out on our methodology page.

Left

1 rated outlet

We have not written our reading of the left coverage of this story. The left-rated outlets that ran it are listed below.

Centre

1 rated outlet

  • The centre-rated report led on the warning from security researchers about a surge in 'LLM-jacking' attacks. It noted that these attacks target companies' costly AI resources and highlighted that hackers are reselling AI-powered accounts on the dark web at discounts of up to 97%. The report also mentioned that hackers are breaching corporate cloud servers to exploit computing resources for free, and that the availability of low-cost AI resources gives attackers a significant economic advantage.

Right

4 rated outlets

  • The right-rated reports focused on the surge in 'LLM-jacking' cybercrime. They highlighted that hackers are stealing AI accounts and company servers to gain cheap access to powerful models and expensive computing resources. These reports noted that the stolen AI access is being resold on the dark web at significant discounts, with one mentioning up to 97% off. The use of these hijacked resources to power automated cybercrime operations and provide attackers with a financial edge over their targets was also a key point. One report quoted Google's Threat Intelligence Group warning about this trend.

Questions about this coverage

How did the left and right cover Hackers Steal AI Accounts in 'LLM-jacking' Surge?
Of the 6 outlets on this story carrying a published leaning rating, 0% are rated left, 20% are rated centre, 80% are rated right. Those percentages are shares of the rated outlets, not of every outlet that ran it, which was 13. The sections above set out what each side emphasised, in its own terms.
Is Hackers Steal AI Accounts in 'LLM-jacking' Surge left or right?
Too few of the outlets on this story carry a published leaning rating to say. 6 of them do, and this site does not characterise a field under 12: at that size one newsroom filing moves the share by ten points. The percentages above are the count as it stands.
Is the coverage of Hackers Steal AI Accounts in 'LLM-jacking' Surge biased?
Hackers Steal AI Accounts in 'LLM-jacking' Surge is one event reported by 13 outlets, and this page does not rate the story as biased or unbiased. What it publishes is the spread: which outlets ran it, where named rating organisations place each of them on the spectrum, and what each side chose to lead with. A leaning rating describes an outlet's record over time, not this article, and the two should not be run together.
Which outlets covered Hackers Steal AI Accounts in 'LLM-jacking' Surge?
13 that we know of, every one of them listed further up this page with a link to its own report and to what we hold on the publisher. Nothing here is a summary of somebody else's summary: the outlets are named so the original reporting can be read.
What is LLM-jacking?
LLM-jacking is a term for the practice where hackers steal AI accounts and cloud computing resources. These stolen assets are then resold on the dark web, often at steep discounts, to power illicit activities and give cybercriminals an economic advantage.
How much are stolen AI accounts being sold for?
Reports indicate that stolen AI accounts and cloud computing resources are being resold on the dark web at significant discounts. Some accounts are available for up to 97% less than their original cost, with one mention of accounts costing up to $200 per month being sold for just a few dollars.
Who has warned about LLM-jacking?
John Hultquist, principal analyst at Google's Threat Intelligence Group, has warned about the surge in LLM-jacking attacks. This trend involves cybercriminals hijacking AI accounts and cloud resources to power their operations.

Read it at the source

13 outlets, grouped by the leaning a published rating gives them. Every headline links to the original; an underlined outlet name opens our profile of that publisher.

Left

1

Centre

1

Right

4

Not rated

7

How did this read?

About the coverage, not about the story. We do not ask whether you agree with what happened — we have no honest use for that answer.

LLM-jacking: AI accounts stolen | MediaBias News