LLMjacking - Stolen API Key Use Against LLM Provider Endpoints

Renata Cardoso@rcardososec

•updated Jul 1, 2026•6•0•24

Detects outbound web requests to OpenAI, Anthropic, or Google Gemini API endpoints that contain suspected API keys (OpenAI 'sk-proj-', Anthropic 'sk-ant-', or Google 'AIza' prefixes) in the request stream, potentially indicating hardcoded credentials, malicious script activity, or data exfiltration.