LLMjacking Attacks: Stolen Cloud Keys Ran Up $1 Million in AI Charges, What Google Confirmed and How to Lock Down Your Cloud Account

Attackers are breaking into company cloud accounts and running AI models on the company's bill. Google's threat intelligence team says some victims were charged more than $100,000 in a single day, and some ran up $1 million before the access was cut off. So any business with a cloud account should check its keys and spending alerts this week, including businesses that have never used AI.

What is LLMjacking?

LLMjacking is stealing someone else's access to large language models (LLMs), the AI models behind chatbots and coding assistants. The attackers don't pay for the AI they use. They get in with a victim's stolen cloud credentials or AI API keys, then use that access themselves or sell it on. The cloud provider sees valid credentials, so it bills the account owner.

Google Threat Intelligence Group (GTIG) and Mandiant published their report on Monday, November 2, 2026. It draws on incidents Mandiant responded to during 2026. Google compares LLMjacking to cryptojacking, where attackers mine cryptocurrency on stolen servers, but notes one key difference: "LLMJacking can generate large spikes in fraudulent cloud charges in a matter of hours."

What Google confirmed

These points come straight from the report:

• The charges: more than $100,000 in a single day at some organizations. At some, the total reached $1 million before the access was revoked.
• Who was hit: organizations in North America, South America and Asia Pacific, in financial services, retail, technology and transportation, across "a variety of cloud and LLM providers." This is not just a Google Cloud problem. The report's detection guidance covers AWS, Azure and Google Cloud.
• The resale market: services Google calls "LLM mixers" resell stolen access. One of them, Jet Night, advertised unlimited plans for about $60 a month, compared with the $100 to $250 a month that legitimate plans usually cost. One actor using it made more than 500,000 API calls in under eight hours, which left the victim with nearly $1 million in token costs.
• AI did not need to be switched on: "In multiple incidents that Mandiant investigated, LLM services were not enabled at the time of compromise." The attackers turned those services on themselves.

How attackers get into cloud AI accounts

Google says exposed or stolen cloud identity tokens were "the dominant initial access vector." The ways in it lists:

• Exposed cloud credentials and service account keys
• GitHub personal access tokens
• Active session tokens. One group, UNC6993, set up a fake app portal that persuaded users to paste in a live token, which got the attackers past both the password and MFA
• AI API keys scraped from public GitHub repositories, which the attackers tested with tiny one-token requests so they wouldn't trigger alerts
• AI servers left open to the internet, such as Ollama
• Flaws in AI gateway software such as LiteLLM

Once inside, the attackers created more API keys and added backdoor accounts or SSH keys. They also searched for more secrets, and in one case launched GPU servers and asked the cloud provider for higher quotas.

The LiteLLM flaw: claimed versus confirmed

Google's report says one group exploited CVE-2026-40217 in a victim's LiteLLM gateway. It describes the bug as a flaw in the key regeneration feature that turned ordinary keys into full admin keys. LiteLLM's own advisory for CVE-2026-40217, published May 7, 2026, describes something different: a sandbox escape in a guardrail testing endpoint. It lets someone who already holds an admin credential run code on the server, and it affects versions 1.81.8 up to 1.83.10. We could not reconcile the two descriptions from the sources. Either way, the advice is the same. The advisory says the fix is in 1.83.11 and recommends that version or later, so install the current release.

Still unknown: how many organizations were hit, which cloud providers they used, total losses, and whether any provider refunded the charges.

What to do this week

Also set up an alert for whenever an AI service is turned on, and for any change to logging. On Google Cloud that event is EnableService. On AWS, watch for PutUseCaseForModelAccess and CreateFoundationModelAgreement. Google says to treat any unauthorized enablement "as a critical security event."

Why this matters for a company network or website

Ransomware announces itself. LLMjacking doesn't: your website stays up and your files stay where they are, and the first sign may be the invoice. The risky keys are usually in ordinary places, like a developer's laptop, a contractor's old test project, or an app that was built quickly and has a key sitting in its code. Stolen credentials also get used fast, as we covered in Infostealer Attacks: Stolen Credentials Used an Average of 8 Minutes After Infection.

If an AI tool built your app, someone still has to own the keys, the logs and the bill. We cover that in AI Can Build Your App. Who Is Going to Keep It Running?. If you run your own AI gateways or model servers, they need the same patching and network rules as any other server. See self-hosting and infrastructure.

LLMjacking questions people are asking

What is LLMjacking?

It is when attackers use stolen cloud credentials or AI API keys to run AI models, or resell access to them, while the victim pays the bill.

Can LLMjacking happen if we do not use AI?

Yes. Google says that in multiple incidents the AI services were not turned on when the attackers got in, and the attackers enabled them.

Is this only a Google Cloud problem?

No. Google's report covers several cloud and AI providers and gives detection steps for AWS, Azure and Google Cloud.

How do I know if my AI API key was stolen?

Watch for sudden jumps in usage or cost, new API keys or service accounts nobody created, AI services that were switched on, and changes to logging settings.

Will the cloud provider refund the charges?

The report does not say. Revoke the keys and contact your provider straight away. Don't count on a refund.

What should we do first?

Set budget alerts today. After that, turn off AI services you do not use and rotate old keys.

The bigger lesson

A cloud key is a credit card with no spending limit unless you set one. Inventory your keys, give each one only the access it needs, and put a person and an alert on the bill.

To get your cloud and website locked down, see security hardening or request a quote.

Get security alerts by email, with the free checklist, at /security-alerts.

Sources: Google Threat Intelligence Group, The Rise of LLMJacking; LiteLLM security advisory GHSA-wxxx-gvqv-xp7p.