Reported by 2 outlets

Timeline

1. original reporting

   Poisoned npm Packages Steal AI Tokens and Spread Them Across Developer Build Environments

   cyberpress.org · 60d ago · August 14th, 2026

   Cybercriminals are increasingly targeting AI API tokens through poisoned npm packages , turning ordinary developer environments into credential-harvesting machines. The stolen tokens can be abused directly or fed into underground “transfer stations” that resell discounted access to expensive AI models. AI token jacking is becoming a costly risk as companies rapidly adopt large language models, automated agents, and AI-powered development tools. Attackers do not need to break into an AI provider. Instead, they steal the API keys that legitimate developers and applications use to access those services. These keys allow automated systems to make requests without requiring an interactive login every time. Since AI providers commonly bill customers based on the number of input and output tokens consumed, a stolen key can quickly generate enormous costs. In some cases, victims may not notice the abuse until the next billing cycle, after attackers have already made millions of API calls. Poisoned npm Token Theft npm supply chain attacks create a particularly dangerous path for token theft. Attackers publish malicious packages or compromise trusted packages that developers install in their projects. Once executed, the code can scan local systems, configuration files, repositories, CI/CD pipelines , and cloud environments for credentials. The threat becomes more serious when malicious packages are self-propagating. A compromised developer may unknowingly include the poisoned dependenc

2. update from gbhackers.com

   Hackers Steal One AI Key, Resell the Compute, and Leave Victims With a Million-Dollar Bill

   gbhackers.com · 60d ago · August 14th, 2026

   A rapidly expanding financial cybercrime model called AI token jacking, where threat actors steal developer API keys for popular AI platforms, consume the victim’s allocated model capacity, and resell that compute through gray-market proxy services. The term “token” in this context does not refer to a browser session token. It refers to the metered units […] The post Hackers Steal One AI Key, Resell the Compute, and Leave Victims With a Million-Dollar Bill appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .