LLMjacking: Google says stolen cloud keys are running up $100,000 AI bills in a day

What Google found

Mandiant, Google's incident response unit, says it handled several LLMjacking cases in 2026 at financial services, retail, technology and transportation companies in North America, South America and Asia Pacific. At some organizations, cumulative charges reached $1 million before access was cut off.

Google compares the tactic to cryptojacking, where attackers quietly mine cryptocurrency on someone else's servers. The difference is speed: Google says LLMjacking can produce large spikes in cloud charges within hours. In several cases, the victims had AI services switched off, and the attackers turned on services such as Amazon Bedrock and the Gemini API themselves before running up the bill.

How attackers get in

The most common way in, according to Google, is an exposed or stolen cloud identity token. That includes cloud access credentials, service account keys, GitHub personal access tokens and active session tokens. Attackers also pulled corporate AI API keys out of public GitHub repositories and probed AI model servers left open to the internet.

One group Google tracks as UNC6993 broke into a cloud server through a misconfigured service account key in mid-2026. It also ran a fake application portal that tricked users into pasting an active access token, which let it get past passwords and multifactor authentication. After getting AI API keys, the group created more keys and enabled services in the victim's cloud projects, running up more than $100,000 in charges.

To avoid detection, one attacker checked stolen keys with tiny requests that asked for a single token of output, which stayed below the volume alerts that security tools watch for. Another kept creating and deleting short-lived accounts to dodge rate limits while checking the victim's billing page to see how much it had spent.

Stolen access for sale

Google says the work is now split between the people who break in and operators of what it calls "LLM Mixers," services that pool stolen access and resell it to paying subscribers. In one case, an attacker made more than 500,000 AI API calls in under eight hours with stolen keys to power one such service, Jet Night, which passed nearly $1 million in token costs to the victim. Google says Jet Night's unlimited plan costs about $60 a month against typical prices of $100 to $250 a month, and believes the service depends on stolen keys to make money.

In one case, a second group obtained pre-validated keys from the group that broke in and exploited a flaw in LiteLLM, a gateway the victim used to route requests to AI models. The bug, CVE-2026-40217, let the attacker turn ordinary keys into full administrator credentials. Google expects criminals to favor LLMjacking over cryptojacking because stolen AI access can be sold right away at high margins.

What it means for you

The attacks Google describes target cloud accounts and the AI API keys tied to them. The people who need to act are the businesses, developers and IT teams that hold those accounts and keys.

Google's advice starts with the basics. Keep API keys in a central secrets manager rather than in code, and turn on automatic secret scanning wherever you store code. Give each key only the access it needs, so a key for a cheap model can't call an expensive one. Set budget alerts, spending caps and per-model quotas on AI services, and use phishing-resistant multifactor authentication on cloud and developer accounts. If you run LiteLLM or another AI gateway, keep it patched, including against CVE-2026-40217.

Google also says any unexpected switch-on of an AI service in your cloud account should be treated as a critical security event. If you don't use AI services, keep them disabled and get alerted if that changes.

Sources

• Google Cloud: The rise of LLMJacking: how threat actors monetize compromised cloud and model resources
• The Register: Token thieves costing companies $100K+ per day in illicit LLM charges