Hackers are stealing access to AI tools and selling it online, leaving victims with huge bills. Learn what token-jacking is and simple ways to protect yourself.
AI Account Theft Is Growing: What “Token-Jacking” Means and How to Stay Safe
Hackers love things that cost a lot of money. Now they have found a new target: access to artificial intelligence (AI) tools. Security researchers say stealing and reselling AI access is turning into a real business for criminals.
What Is Token-Jacking?
An API key is like a secret password that lets an app use an AI service. A session token is a digital pass that shows you are logged in. Token-jacking means stealing those keys or passes and using them without permission. Cybernews reported that researchers at Palo Alto Networks Unit 42 are seeing an economy where access to top AI models is sold through hijacked accounts.
How Do Thieves Do It?
Cybernews says attackers steal keys through phishing, which means tricking people with fake messages, and through malware, which is harmful software. They also use exposed code, tainted software packages and dark web markets. A security report from Okta adds that newer data-stealing programs now look for keys that belong to AI companies such as Anthropic and OpenAI.
What Do They Do With Stolen Access?
According to Cybernews, thieves can create new keys, remove spending limits and turn off alerts, so the real owner does not notice. Some sellers advertise cheap access to AI tools on online marketplaces, and their customers may be people who just want low-cost AI.
How Much Can It Cost?
Quite a lot. Okta describes three recent cases: nearly $1 million for one organization, a surprise $25,000 bill for a software architect and $600,000 in AI credits for an AI testing group, all tied to stolen keys. The Unit 42 researchers warn that “The financial impact of token-jacking can be catastrophic.”
How Can You Stay Safe?
Cybernews says the researchers urge organizations to protect their access keys and set strict spending limits. Here are some simple habits for everyone:
- Never share your passwords or keys, even with a friend.
- Only download software from official websites.
- Turn on two-step login when it is offered.
- Set spending limits and alerts on any AI account that charges money.
- Ask a trusted adult for help if a message or download looks strange.
Why It Matters
As AI becomes part of school, work and play, protecting your accounts becomes just as important as locking your front door.
This content is provided by AIxAverage.com for general educational and informational purposes and does not constitute any substantive advice. It was developed with support from AI and reviewed by our editorial team for accuracy. Even so, AI-assisted material can contain errors, omissions, or information that is no longer current. We always encourage our readers to confirm any important details with trusted, independent sources.
