Stealing an AI key: four links and someone else's meter

In brief: LLMjacking uses stolen credentials to charge AI usage to someone else's account. The article examines access, consumption, resale and knowing purchase in Spain and Norway: each act requires proof of its legal elements, and the proposed classifications of consumption are the author's interpretations.

Imagine a five-person administrative services firm in Valladolid. Clara runs it and has built a tool that uses an AI model to prepare first drafts of letters. It costs her about €60 a month. It saves time, and she reviews the output.

Her program talks to the model through an API: a door through which it sends what it needs and receives a response. The API key is what it presents at the door to say: “It's me. Charge it to my account.” Each request is measured in tokens, small units of text, and billed at the end of the month.

One Friday, Clara accidentally uploads her tool's code to a public repository with the key still in it. Someone finds it, checks that it works and starts using it. Then they resell access: others pay to send requests through them. Some know they are running up charges on someone else's account.

In the early hours, while the office is closed, the requests multiply. In the morning, Clara opens an alert: she has run up €1,480 in charges. Nobody in her office worked that night. She calls the provider. They tell her the requests were made with her key and the account is hers. Clara revokes the key and disputes the charge.

On 30 October 2026, Wiz published an analysis of incidents across nine AI development platforms.[1] Examining two enterprise keys, it recorded around 800,000 calls in 30 hours with one and 1.7 million in 13 hours with the other, including failed attempts.[1] It estimated more than $100,000 in combined usage at public rates, with no verified invoice.[1]

At Clara's firm, the meter has kept running in her name. LLMjacking means exploiting stolen credentials to charge AI usage to another account.[2] I want to follow the chain from there: getting in, tapping into the meter, selling the supply and buying it knowing where it comes from. Each link raises a different question of liability.

I work in the Spanish and Norwegian jurisdictions, so I focus my analysis on those two countries.

Four links, four questions of criminal law

1. Entering the property: obtaining the key and accessing someone else's system.
2. Connecting the cable to the meter: consuming computing resources at the account holder's expense.
3. Selling the service: turning stolen access into a business.
4. Buying knowingly: using the supply while knowing its unlawful origin.

Each link requires proof of the elements of the offence and an assessment of how it relates to the others.

1. Entering the property

Spain. Article 197 bis.1 criminalises unauthorised access that breaches security measures, or remaining in a system against the wishes of the person entitled to control access. Article 197 ter covers obtaining passwords or codes without authorisation and with the intention of facilitating the offences it lists.[3]

STS 849/2025, drawing on the reasoning in STS 15/2023, treats an access key as an identifier of its holder. The former concerned privacy and access to personal information under Article 197.2.[4] I use it to explain what is usurped when someone uses another person's credentials: the virtual identity that opens the door.

Norway. § 201 covers obtaining or possessing access data with criminal intent; § 204 covers gaining entry by breaking through protection or by other unlawful means.[5]

HR-2026-1908-A applied both provisions to Snapchat passwords obtained from a database of leaked credentials. HR-2024-999-A did the same with leaked credentials and access to Facebook.[6][7] These were personal accounts: extending that reasoning to an API key is my reading. The door changes; the credential still provides entry to someone else's system.

2. Connecting the cable to the meter

Getting in makes consumption possible. This is where the loss begins, and it can keep growing while nobody checks the account.

Spain. Article 255 criminalises fraud involving the use of “telecommunications or any other element, energy or fluid belonging to another”, among other supplies, through fraudulent mechanisms, tampering with meters or “any other clandestine means” (my translations).[3]

I would argue that this wording leaves room to consider clandestine consumption of someone else's computing resources. An illegal hook-up is a good description of using the supply while leaving the account holder to pay. We have not found a judgment applying Article 255 to AI or cloud services.

The alternative is the Spanish offence of computer fraud under Article 249.1.a. STS 509/2018 held that identifying oneself to an ATM with someone else's PIN constituted computer manipulation, even if the PIN had been obtained without committing an offence; it applied the former Article 248.2.a.[3][8]

For clandestine consumption of a supply, my starting point would be Article 255. Where an operation for financial gain is shown to cause unauthorised transfers of assets, I would argue for Article 249.1.a. The distinction matters: the former provides for a fine; computer fraud carries imprisonment. A large bill calls for those elements to be investigated, but does not replace proof of them.[3]

Norway. § 12 treats electrical or other energy as a thing: that is why stealing electricity can amount to tyveri, theft. That equivalence does not extend to computing services.[9]

I would look to § 371 b: unlawful gain, unlawfully influencing the outcome of automated data processing, and loss or risk of loss. § 372 allows consideration of aggravated fraud, taking into account factors including the financial harm and the systematic or organised nature of the conduct.[10] My argument is that the key makes the system process and attribute usage to someone who did not authorise it.

3. Selling the service

In May 2024, Sysdig described a reverse proxy used to sell access to models through stolen credentials. The buyer sends requests to the intermediary, who uses the compromised account without revealing the key.[2]

Wiz also saw signs of resale when analysing two enterprise keys linked to an unidentified compromised provider, without establishing a definitive link between resellers, the compromise and the traffic.[1]

Spain. Article 197 ter covers supplying passwords or codes to third parties with the required criminal purpose.[3] Selling a key raises that question directly. Where a proxy hides it from the buyer, we need to examine what is being supplied and how the seller participates in the consumption fraud described in the second link.

Norway. § 201 includes making access data available to another person. For fraudulent exploitation of the service, I would return to § 371 b and, if the elements of aggravation are present, § 372.[5][10]

To me, this is the most serious link: this is where the business lies. The reseller charges for something whose cost they divert to someone else's account, turning compromised access into an offer for more consumers. The victim's meter underpins the commodity they sell.

4. The buyer who knows it is stolen

Paying the intermediary does not authorise charging usage to the account holder. I also want to look at those who buy knowing how the illegal hook-up works.

Spain. The Provincial Courts of Guadalajara and Cuenca explain, in relation to Article 255, that “it is enough for the perpetrator to know that the supply is being obtained unlawfully and to keep consuming it” (my translation). They do not have to have installed the illegal hook-up.[11][12]

If my argument that computing falls within that provision is accepted, I would argue that it extends to a buyer aware of the unlawful origin. Their role is to use the supply, even if someone else connected the cable.

Norway. § 332, handling stolen proceeds (heleri), requires receiving or obtaining, for oneself or others, a share of the proceeds of an offence; it also includes a service that replaces those proceeds.[13] HR-2024-999-A overturned a conviction under this provision because merely retaining the proceeds is not enough: they must be received or obtained.[7]

My reasoning is that the buyer receives a service each time they request and obtain processing through the intermediary. That opens the possibility of applying § 332 to someone who knows its criminal origin; treating the service as proceeds or a substitute for them is the inference I propose.

What about the EU?

There is no common European offence or criminal court for this. Criminal law is national; the EU sets minimum standards.

Directive 2013/40/EU covers links 1 and 3: access that infringes a security measure (Art. 3), and selling or making available passwords or codes with the intention of facilitating the offences in Arts. 3–6 (Art. 7.b).[14] Its Art. 12 requires jurisdiction where the offence takes place wholly or partly within the territory or targets a system located there, even if the perpetrator is abroad: the fact that Clara's key is stolen from abroad does not prevent her reporting it in Spain, though it does not guarantee the outcome.[14]

Art. 6 of Directive (EU) 2019/713 addresses link 2: fraud through information systems that causes a transfer of money, monetary value or virtual currency; it requires a maximum sentence of at least three years (Art. 9.4).[15] Treating computing usage as “monetary value” (my translation of the quoted term) is my interpretation.

I have not found any CJEU judgments interpreting Directive 2013/40 on credentials.

These directives do not bind Norway: they are not part of the EEA Agreement. What Norway shares with Spain is the Budapest Convention, ratified by Norway in 2006: illegal access (Art. 2), devices and passwords (Art. 6), and computer fraud (Art. 8).[16]

Storm-2139: a real chain of alleged conduct

Microsoft attributed the acquisition of exposed credentials, unlawful access and the sale of tools or access to Storm-2139. Its account shows the chain as an organised activity brought before a civil court.[17]

On 26 May 2026, Magistrate Judge Fitzpatrick recommended default judgment and permanent injunctive relief against three defendants. The document is a recommendation, not the final judgment, and Microsoft was then seeking to stop the activity, without monetary damages.[18] The case file gives substance to the example; it does not establish that every buyer knew where the access came from.

Being a victim does not wipe out the bill

AWS makes the customer responsible for activity on their account, including unauthorised activity, except to the extent caused by a breach by AWS. OpenAI makes the customer responsible for account activity; Anthropic makes them responsible for the fees generated by it.[19][20][21]

Microsoft offers a discretionary, one-time fraud credit in the CSP channel, subject to conditions; it is not a general Azure refund.[22]

Clara can report that someone used her key and still find herself disputing that €1,480 with the provider. The account holder can be the victim of a crime and still owe the usage charges. I would prepare both the criminal complaint and the challenge to the charge from the outset: the applicable contract, logs and evidence of the compromise. The meter can still be yours while you investigate who connected the cable.

To challenge that bill, I would ask for normal usage to be separated from other people's requests and for a reconstruction of when the tapping began. It is the same question I would ask about a meter spinning too fast: who is using the supply I am being charged for?

Watch your meter

Before connecting an application, I would ask: “When we reach the limit, what gets cut off, and when?”

• Check the cut-off. Azure Budgets alerts you but does not stop consumption; AWS Budgets updates up to three times a day. OpenAI documents a hard limit that is not enforced instantaneously; Anthropic pauses the API when the tier's monetary cap is reached.[23][24][25][26]
• Limit the scope of each key. Minimum permissions, separation by application and environment, and secrets kept out of the code.[27][28]
• Act on a suspicion. Revoke the key and review access and logs.[29]

I want Clara to be able to reconstruct the whole chain: who opened the door, who connected the cable, who sold the supply and who bought it knowing where it came from. Finding her key in the logs is the start of the investigation.

Four links. Someone else's meter. The business gets paid; the account holder gets the bill.