Google: LLMjacking attacks rack up $1 million in cloud AI charges
million has a newly disclosed security flaw that anyone running it should know about.
Companies can record costs as high as $1 million due to fraudulent calls using stolen API keys, researchers at Google's Threat Intelligence Group (GTIG) and Mandiant in analyzed incidents.
Criminals who break into corporate cloud accounts are using the stolen access to run AI models at the victim’s expense , in some cases racking up more than $100,000 in charges in a single day, Google Threat Intelligence Group (GTIG) and Mandiant researchers have found.
Most often, though, the way in was a stolen cloud credential, such as a service account key, a GitHub access token or an active session token.
The researchers found several examples of such relaying infrastructure, including Jet Night, which sells “unlimited access plans” for $60/month, and the newapi[.]pro service.
Large language model hijacking attacks, also known as LLMjacking, are generating large fraudulent cloud charges, with some organizations losing more than $100,000 per day.
LLM mixers offer access to AI resources at very low prices, using their proxy infrastructure to relay customers' prompts to hijacked services through stolen API keys.
The researchers have also observed threat actors exploiting CVE-2026-40217, a vulnerability in LiteLLM that allows running arbitrary code on the server by leveraging the custom-code guardrail testing endpoint.
Google recommends several actions to protect against LLMjacking attacks, which start with prioritizing Identity and Access Management (IAM) and securing the supply chain.
Enforcing phishing-resistant multi-factor authentication (MFA), ensuring monitoring tools provide comprehensive visibility across the environment to identify unauthorized LLM and AI services (shadow AI), and setting API usage and spending limits can help organizations detect LLMjacking attacks early, limit their impact, or prevent them altogether.
Based on their observations, there are "two distinct operational clusters coordinating to compromise and monetize enterprise LLM infrastructure." The researchers identified two categories of threat actors: those who scan for publicly exposed LLM endpoints and those who steal valid API keys from unprotected machines.
What happened
Companies can incur costs as high as $1 million due to fraudulent calls made with stolen API keys, according to researchers at Google's Threat Intelligence Group (GTIG) and Mandiant who analyzed these incidents.
Criminals breaking into corporate cloud accounts are exploiting stolen access to run AI models at the victim’s expense, with some cases racking up over $100,000 in charges in a single day, as found by researchers from Google GTIG and Mandiant.
What changed
Most often, the entry point was a stolen cloud credential, such as a service account key, a GitHub access token, or an active session token.
The researchers identified several examples of relaying infrastructure, including Jet Night, which offers 'unlimited access plans' for $60/month, and the newapi[.]pro service.
Who is affected
Large language model hijacking attacks, known as LLMjacking, are leading to substantial fraudulent cloud charges, with some organizations losing over $100,000 daily.
LLM mixers provide access to AI resources at very low prices, using their proxy infrastructure to relay customer prompts to hijacked services through stolen API keys.
Why it matters
The researchers have noted that threat actors are exploiting CVE-2026-40217, a vulnerability in LiteLLM, which enables the execution of arbitrary code on the server by leveraging the custom-code guardrail testing endpoint.
Google recommends several actions to defend against LLMjacking attacks, starting with prioritizing Identity and Access Management (IAM) and securing the supply chain.
Technical details
Implementing phishing-resistant multi-factor authentication (MFA), ensuring monitoring tools provide comprehensive visibility to identify unauthorized LLM and AI services (shadow AI), and setting API usage and spending limits can assist organizations in detecting LLMjacking attacks early, limiting their impact, or preventing them altogether.
Based on their findings, there are 'two distinct operational clusters coordinating to compromise and monetize enterprise LLM infrastructure.' The researchers categorized threat actors into two groups: those scanning for publicly exposed LLM endpoints and those stealing valid API keys from unprotected machines.
In some instances, Google reported that attackers utilized the victim's cloud infrastructure to host unauthorized proxy endpoints and agentic workloads.
Response
In several incidents investigated, the AI services had been turned off at the time of the compromise, with attackers using stolen access keys to reactivate them.
Attribution
BleepingComputer: Large language model hijacking attacks, also known as LLMjacking, are generating large fraudulent cloud charges, with some organizations losing more than $100,000 per day.
Help Net Security: Criminals who break into corporate cloud accounts are using the stolen access to run AI models at the victim’s expense , in some cases racking up more than $100,000 in charges in a single day, Google Threat Intelligence Group (GTIG) and Mandiant researchers have found.
What to watch next
Watch for new exploitation reports and updated indicators of compromise.