Inference Theft Is the New AI App Security Bug: How to Protect Your LLM Endpoints

If your app exposes an AI endpoint, your most expensive infrastructure might now be the easiest one to abuse. A normal HTTP request is cheap. A single request that triggers a frontier model, a long agent loop, web search, embeddings, tool calls, or code execution is not. That gap is what people are calling inference theft: attackers using your public AI routes as a free model proxy until your bill, quota, or latency explodes. This is not just a “set a rate limit and chill” problem. AI requests...