On August 6, 2026 Palo Alto Networks’ Unit 42 published an account of what it calls AI token jacking: the theft of the API keys developers use to reach commercial AI models, followed by unauthorised consumption or resale of that access. Unit 42 says it has responded to a growing number of these cases. In one incident-response engagement, stolen credentials were folded into an attack within minutes and generated nearly a million dollars in charges before the victim discovered them.
The resale side is the part that turns a leaked key into an industrial-scale bill. Unit 42 describes gray-market intermediaries it calls transfer stations, which sit between buyers and the official AI platforms and sell discounted model access. They run open-source proxy software that handles obfuscation, credential rotation, billing and model routing, and they advertise on Chinese-language marketplaces including Taobao, offering access to multiple AI services against seller-issued custom credits. Unit 42 reports that this infrastructure can drive tens of millions of API calls per day, producing hundreds of thousands of dollars in usage fees on someone else’s account.
The recommended controls are mostly ordinary cloud hygiene applied to a new spend surface: set spending limits with alerts on baseline changes, review which privileged accounts can provision resources, move off long-lived static keys to short-lived bearer tokens, put an AI gateway with machine authentication in front of model access, draw network boundaries around inference infrastructure, and manage development environments tightly enough that a malicious package cannot lift credentials.
What makes this different from generic key theft is the economics. A leaked cloud key usually costs an attacker effort to monetise; a leaked AI key is itself the product, with a ready buyer pool and a price. That inverts the usual assumption that low-privilege service credentials are low-risk, and it means the first signal of compromise for many organisations will be a finance alert rather than a security one. Metered AI spend now belongs on the same footing as any other credential-backed budget: capped by default, owned by a named team, and alarmed on deviation rather than reviewed monthly.