LLMjacking: Google warns stolen AI access is running up bills of up to $1M
Google's threat intelligence team says attackers are hijacking companies' cloud AI access and reselling it, with charges topping $100,000 in a day. Here is how it happens and the controls that stop it.
- Author
Umair Mateen- Published
- Reading time
- 3 min
- Category
- AI
Ideas in this post
Tap one for a 5-second answer. Underlined words in the article work the same way.
0 of 1 understood
Google Threat Intelligence Group and Mandiant published a report on “LLMjacking” on 2 November 2026. It describes attackers taking over organisations' paid access to AI models in the cloud, then using or reselling it. In individual incidents, fraudulent charges passed $100,000 in a single day, and some organisations reached about $1 million before the access was cut off.
What LLMjacking is
Most companies that build with AI pay for model access through a cloud account or an key. LLMjacking means someone else gets hold of that access and runs their own workloads on your bill. Google compares it to cryptojacking, where attackers mine cryptocurrency on stolen servers, but says the costs can spike within hours rather than build up slowly.
Mandiant says it handled several incidents in 2026, across North America, South America and Asia Pacific, in financial services, retail, technology and transport.
Quick check · Everyday ↔ real
The restaurant and the API, side by side
Switch between the two and see how each part lines up.
- You, the customer
- The menu
- Your order to the waiter
- The kitchen
- Your dish, or "sold out"
You order from the menu and the waiter brings back your dish, without you ever seeing the kitchen.
| Everyday | Real |
|---|---|
| You, the customer | The client (your app) |
| The menu | The documentation |
| Your order to the waiter | The request |
| The kitchen | The server |
| Your dish, or "sold out" | The response, or an error |
From the explainer What is an API? Explained with a waiter in a restaurant
How attackers get in
- Stolen cloud credentials were the most common route: access keys, service account keys, GitHub personal access tokens and live session tokens.
- API keys left in public code. One group harvested AI keys from public GitHub repositories and tested them with tiny requests designed not to trigger alerts.
- Exposed AI servers reachable from the internet.
- Phishing for tokens. One group ran a fake portal that tricked people into pasting session data, which got around passwords and multi-factor authentication.
Once inside, attackers created extra admin accounts and backdoors to stay in, and in some cases switched on AI services the victim had never enabled.
How they make money
Some run heavy AI workloads directly. Others resell the access through underground “mixer” services that pool stolen keys and sell cheap AI usage. The report describes one such service that made more than 500,000 AI calls in under eight hours, passing close to $1 million in costs to a single victim, and advertised an unlimited plan for about $60 a month.
Who should care
Any business with a cloud account, or with API keys for an AI provider, even if you barely use AI yet. Several victims had never turned AI services on; the attackers did it for them.
Limits and caveats
- The dollar figures are from incidents Mandiant investigated, not an industry average.
- The report focuses on cloud platforms (AWS, Azure and Google Cloud) and AI gateways; the same logic applies to direct API keys from AI labs.
- Spending caps help but are not enough on their own, because attackers can create new accounts and keys once inside.
What to do this week
- Set budget alerts and per-model spending caps on every cloud and AI provider account.
- Treat switching on an AI service as a security event. Alert when one is enabled in an account that didn't use it before.
- Scan your repositories for secrets, including old and public ones, and rotate any key you find.
- Narrow your API keys so each one can only call the models and environments it needs.
- Use phishing-resistant multi-factor authentication for cloud consoles and developer platforms.
- Patch AI gateways such as LiteLLM; the report names CVE-2026-40217 as one attackers used.
The DevDrift builds AI systems with scoped keys, spending limits and audit logs from day one, if you want a review of your setup.
