"Token Jacking": Attackers Are Stealing AI API Credentials — and Leaving Almost $1M in Charges

By Craig Lowther, Founder · 9 August 2026 · 6 min read · Cost Guard — Threat Intelligence

Someone steals your credit card, and your bank stops it within minutes. Someone steals your AI API key, and they can burn close to $1 million before anyone notices — because nothing is watching the meter.

Palo Alto Networks' Unit 42 has disclosed a new and rapidly growing attack class it calls "token jacking": attackers steal corporate AI/API credentials, feed them into grey-market AI proxy services, and resell the stolen capacity — leaving the credential owner with the bill.

~$1M

in charges before discovery, in cases investigated

Minutes

from credential theft to active resale infrastructure

10M+/day

API calls a single stolen credential can be forced to generate

What Happened

Unit 42 says it has responded to a growing number of these cases, producing what it describes as "staggering financial losses." The pattern is consistent: attackers obtain corporate AI/API credentials — from exposed repositories, infostealer malware, phishing, or compromised npm packages — and plug them into grey-market AI proxy services capable of generating tens of millions of API calls per day.

In the cases Unit 42 investigated, stolen credentials were incorporated into this resale infrastructure within minutes of compromise. By the time the victim organisation discovered what was happening, charges had climbed to nearly $1 million.

There's an especially nasty escalation path buried in this: a compromised privileged developer account can be used to create additional API keys, provision new models, remove billing limits, and disable usage alerts and logging — all before a single suspicious API call is even made. Credential compromise doesn't just enable the theft; it can simultaneously disable every control that would have caught it.

Why This Is a Different Kind of Cost Guard Problem

We've written before about Rippling's accidental AI overspend — ordinary employees defaulting to expensive models, with no attacker anywhere in the picture. Token jacking is the other half of the same problem, and arguably the more dangerous half: this is deliberate, malicious financial exploitation, not uncontrolled internal usage.

That gives Cost Guard's threat model two very different sides to defend against:

Accidental spend (Rippling)

Well-intentioned employees or agents defaulting to expensive models, looping without bounds, or missing token limits — no malice, just missing guardrails.

Deliberate spend (token jacking)

Attackers actively weaponising stolen credentials for financial gain, often disabling the very alerts and limits that would expose them.

The attack starts as a classic cybersecurity problem — credential theft, supply-chain compromise, phishing — but the payload is financial resource theft. That means this is exactly the intersection Thuban was built to sit across: Shield, Guardian and Cost Guard, working the same incident from three different angles.

What a billing dashboard can't tell you (but Thuban can correlate)

Which process actually made this call — a legitimate agent, or something unrecognised?
Which credential was used, and was that credential's behaviour ever like this before?
Which model was called — and does that match the task, or is it wildly out of pattern?
Did usage accelerate right after a dependency update, a config change, or a new key being issued?
Did the account that issued this new API key also just disable billing alerts?

A billing dashboard shows you a number going up. It can't tell you whether the process behind that number is your agent or someone else's.

What Unit 42 Recommends — and Where Cost Guard Fits

Unit 42's own recommendations read like a Cost Guard roadmap: AI spending limits, anomaly detection, short-lived credentials, machine identity, and real-time monitoring. Static code analysis alone — the "did you leave a loop unbounded" check most Cost Guard coverage started as — catches the accidental half. The deliberate, attacker-driven half needs runtime behavioural detection: noticing when a credential's usage pattern suddenly doesn't look like the workload it's supposed to be doing.

Where this is heading for Cost Guard

This incident sharpens Cost Guard's threat model considerably. Today, Cost Guard's static rules (TCG-101 unbounded AI loop, TCG-201 missing output token limit) catch the code shapes that make accidental overspend possible. Token jacking makes the case for extending that with anomaly-based detection of credential misuse — sudden spend acceleration, model usage that doesn't match historical pattern, and new-key-issuance-plus-alert-disabling treated as a single correlated event rather than three unrelated log lines.

The Positioning

We now have real-world evidence for both sides of the AI spend problem:

AI can burn your money accidentally. Attackers can burn it deliberately. Either way, by the time a human checks the invoice, it's already too late — the only thing that works is something watching the meter in real time.

Positioning

Someone steals your credit card and the bank stops it. Someone steals your AI API key and they can burn $1 million before you notice.

AI security has always meant protecting your code and your infrastructure. It now also means protecting your bill. Thuban Cost Guard: because AI security now includes protecting the bill.

Sources

Palo Alto Networks Unit 42: "Token Jacking — Cybercriminals Could Be Stealing Your AI Resources"

Do you know exactly which credentials are calling which AI models right now?

Free, no signup, runs entirely locally — your code never leaves your machine.

npx thuban protect

Cost Guard runs automatically in every scan — no extra flag needed.