LLMjacking - Stolen API Key Abuse Against LLM Provider Endpoints

Renata Cardoso@rcardososec

•updated Jul 1, 2026•0•0•3

Detects suspicious patterns of LLM API usage by monitoring outbound traffic to major LLM providers (OpenAI, Anthropic, Google, DeepSeek, Mistral, Cohere). The rule identifies potential API key theft ('LLMjacking') by flagging high request volumes from single keys, usage of the same key across multiple distinct source IP addresses, and direct outbound traffic bypassing established proxy/gateway configurations.