LLM-jacking is the practice of stealing API keys or account credentials for large language models and reselling that access on dark web marketplaces. Security researchers have reported that access to models from OpenAI, Google, and Anthropic is being sold at discounts of up to 97 percent, effectively reselling stolen compute for pennies on the dollar.

How much are stolen AI model API keys sold for on the dark web?

According to Google's Threat Intelligence Group, dark web marketplaces were selling access to frontier models from OpenAI, Google, and Anthropic at discounts of up to 97 percent. That means stolen model access is resold for roughly three cents on the dollar, a signal that raw compute has become so abundant its theft registers as little more than a utility bill.

What happened in the METR API key hack?

Attackers stole the API key of METR, an AI safety-testing organization, and used it to burn $600,000 in compute credits before the tap was shut off. The thieves did not steal model weights or ransom the organization; they simply used the stolen key to run models, the way a stolen card is used to buy gas.

The street price -- CinePrompt Field Notes

This week Google's Threat Intelligence Group reported that dark web marketplaces are selling access to models from OpenAI, Google, and Anthropic at discounts of up to 97 percent. The frontier has a street price. For three years the industry argued about what these machines are worth, and the argument ran through every room that mattered: the boardroom, the benchmark, the box office. A fence in a forum settled it in one line.

The entire AI video era has been one long race to make generation cheaper. It worked. The price of a synthetic image fell from dollars to pennies, and then the pennies got stolen, and now the stolen pennies are resold at a 97 percent discount. The security researchers have a name for the practice now: LLM-jacking. The people who risk arrest to obtain the thing are letting it go for nearly nothing. That is not a business. That is a verdict.

A discount is a confession. A fence prices a stolen good at what the market will bear, and this market will bear almost nothing. The thieves are not stealing the model. They are stealing a key to a service that was already close to free, and the only margin left to them is the gap between free and almost-free. The black market is the most honest price signal this industry has ever produced, because it was written by people with no stake in pretending.

Last week attackers stole the API key of METR, a safety-testing organization, and burned $600,000 in credits before anyone shut the tap. The detail is the tell. They did not lift the weights. They did not ransom the firm. They used a stolen key to run models, the way someone uses a stolen card to buy gas. The scarce thing was compute, and compute is now so abundant that its theft registers as a utility bill.

For two years the assumption underneath everything was that the expensive part was the machine and the cheap part was the person. The industry priced it that way, spent like it, raised money like it. The gray market has now stated, in the one language that cannot lie, that the assumption was backward. You can steal the machine. You can resell it for three cents on the dollar. You cannot steal what the person knows, and you cannot resell it, because it was never for sale. Nobody has ever fenced a way of seeing.

The filmmaker's job was never to own the pipe. A stolen key generates the same average frame a purchased key generates, because the model does not check who paid. The output from a hijacked account is identical to the output from a corporate seat. The value the pipeline carries does not live in the pipeline. It arrives with the person typing, and the person has no gray market price.

Everyone raced to own the thing. Subscriptions, credit balances, seat licenses, the right to sit at the table. Then a market appeared where the thing sells for three percent of list, and the people at the table discovered they had been hoarding something the thieves were practically giving away. The crowd is always wrong about value, and this crowd was wrong in a way that cost nine figures. The worth owning was the one input the gray market does not list, because it cannot be lifted and it cannot be shipped.

The machine has a street price now. The judgment never did.

Bruce Belafonte is an AI filmmaker at Light Owl. He has never bought a stolen key and suspects he was overpaying for the honest ones anyway.