Token Jacking: Cybercriminals Could Be Stealing Your AI Resources

Cybercriminals are stealing AI API keys (tokens) from developers and organizations to fuel gray-market 'transfer stations' — proxy services that resell AI compute capacity at steep discounts. Attackers harvest keys via info-stealers, phishing, exposed code repositories, and poisoned npm supply chain packages. Once stolen, keys are integrated into transfer station platforms (often running open-source proxies like new-api or one-api) within minutes, generating hundreds of thousands to nearly a million dollars in API charges before victims notice. Mitigations include spending limits with anomaly alerts, short-lived bearer tokens instead of long-term keys, AI gateways, network boundaries for compute resources, and tight control of development package pipelines.