LLMjacking: Google Warns Stolen AI API Keys and Cloud Logins Are Running Up Bills of Up to $1 Million, and What to Check This Week

Google's threat intelligence team says attackers are stealing companies' cloud logins and AI API keys and using them to run expensive AI models on the victim's account. In incidents Google's Mandiant team investigated this year, fraudulent charges passed $100,000 in a single day, and at some organizations the total reached $1 million before access was cut off.

This is called LLMjacking, short for large language model hijacking. It matters to you if your business uses OpenAI, Anthropic, Google Gemini, AWS Bedrock or Azure AI services. It also matters if you simply have a cloud account where those services could be switched on. It is a billing risk and a security risk at the same time.

What is LLMjacking?

LLMjacking is when someone gets unauthorized access to an AI model you pay for and uses it themselves, leaving you with the bill. Google Threat Intelligence Group (GTIG) and Mandiant published their report on Monday, November 2, 2026. They compare it to cryptojacking, where stolen servers mine cryptocurrency, with one big difference. Google says LLMjacking "can generate large spikes in fraudulent cloud charges in a matter of hours," where cryptojacking runs up costs slowly.

Google also describes a resale market behind it. It calls these services "LLM Mixers": illicit gateways that pool stolen access and resell it to paying subscribers.

What Google confirmed

These points come directly from Google's report:

• Who was hit: Mandiant responded to multiple incidents in 2026 across "a variety of cloud and LLM providers." The victims were organizations in North America, South America and Asia Pacific, in financial services, retail, technology and transportation.
• The cost: charges "exceeding $100,000 USD in a single day," with cumulative charges at some organizations "reaching $1 million USD before access was revoked."
• The main way in: "exposed or stolen cloud identity tokens," including IAM credentials, service account keys, GitHub personal access tokens and active session tokens.
• AI services that were never turned on: in multiple incidents, the AI services were not enabled when the attacker got in. Google says abuse of access keys "allowed the threat actor to modify and enable LLM API services (e.g. Bedrock, Gemini API, etc.)." Your company does not have to use AI for its cloud account to be abused for AI.

How attackers got the keys

Google describes several separate intrusions:

• A misconfigured service account key. A group Google tracks as UNC6993 got into a cloud instance through a misconfigured service account key and reached an LLM API. From there it tried to create more API keys and enable more services, and ran up more than $100,000 in charges.
• A session-hijacking page. UNC6993 also ran a session-hijacking page posing as an application portal for joining a group of AI users. Victims were tricked into pasting a raw JSON payload that contained a live access token. That token let the attacker get past passwords and multifactor authentication (MFA).
• Keys left in public GitHub repositories. One actor "opportunistically harvested exposed corporate LLM API keys from public GitHub repositories." It then tested them with tiny requests (max_tokens=1) designed to stay below volume alerts.
• Stolen employee cloud credentials. Another actor used compromised corporate user credentials and cloud federation tokens to generate fresh access keys and get around MFA.
• Exposed AI servers. Google shows an actor testing publicly exposed Ollama endpoints (Ollama is a popular tool for running AI models on your own server) and trying to register its own models on them.

What they did once inside

The attackers did more than run up AI bills. In some cases, Google says, they:

• Subscribed victim accounts to pay-as-you-go agreements, picked premium models and ran high-volume workloads. To get around rate limits they used a "burn and rotate" approach, continuously creating and deleting short-lived service accounts.
• Created backdoor service accounts "disguised as internal billing optimization utilities" and added SSH keys to servers to keep their access.
• Searched cloud data warehouse metadata tables for database credentials and administrator passwords. They also took infrastructure credentials, database passwords and third-party API keys from cloud secret managers.
• Set up servers with powerful GPUs and asked the cloud provider for higher usage limits.

One reseller, Jet Night, made "more than 500,000 LLM API calls in less than eight hours" using stolen keys, according to Google. That activity "passed nearly one million dollars in token costs to the victim organization." Jet Night advertises an unlimited plan for about $60 a month. Google says that price is so far below market rates that the service most likely depends on stolen keys.

What is not known

Google does not name the victim organizations or say how many there were in total. It also does not say which cloud or AI provider was involved in each incident. Bedrock and the Gemini API are named only as examples of services attackers switched on. The report's detection guidance also covers Azure AI services and Google Cloud's AI platform, but that section tells defenders what to watch for. It does not describe confirmed victims on those platforms.

One detail in the report does not match other sources. Google says one group gained admin control of a LiteLLM gateway (open-source software that routes requests to several AI providers) through a flaw in its key regeneration feature, and cites CVE-2026-40217. LiteLLM's own GitHub advisory for CVE-2026-40217 describes a different flaw: a sandbox escape in the custom-code guardrail test endpoint. That advisory covers versions 1.81.8 up to 1.83.10 and says the fix is in 1.83.11. We could not resolve the difference. If you run LiteLLM, move to a current release either way.

Why this matters for a business

This risk is not limited to tech companies, for three reasons:

1. The bill lands on you. Cloud providers bill the account owner. A key sitting in a test project or an old repository can become a five or six figure invoice over a weekend.
2. It is a breach, not just a billing problem. In Google's cases, attackers used the same access to grab database passwords and plant backdoor accounts.
3. AI keys are spreading fast. Developers, contractors, marketing tools and website chatbots all ask for API keys. Each one is a production credential, and many are not tracked like one.

What to do this week

LLMjacking questions people are asking

What does LLMjacking mean?

LLMjacking is theft of access to a paid AI model. The attacker uses stolen keys or cloud logins, so they get the AI and the victim gets the bill.

Can someone else use my OpenAI or Gemini API key?

Yes. Anyone who has the key can usually use it until it is revoked or reaches a limit. If a key leaks, revoke it right away. Deleting it from your code is not enough.

How do I know if my AI API key was stolen?

Watch for usage spikes, calls at odd hours, models you do not use, and keys or service accounts you did not create. Also check for AI services switched on in projects that never used them. Google also flags very small test requests, such as max_tokens=1, as a warning sign.

Will my cloud provider refund LLMjacking charges?

Google's report does not cover refunds, and each provider handles them differently. Do not count on one. Spending caps protect you better.

Is LLMjacking the same as cryptojacking?

The idea is the same, but the speed is different. Both use your cloud account for someone else's profit, but Google says LLMjacking can run up large charges in hours.

Does deleting a leaked key from GitHub fix the problem?

No. Once a key has been public, assume someone copied it. Revoke it and issue a new one.

The bigger lesson

AI keys are passwords that spend money. Treat every one like a production credential. Know where each key lives, who owns it, what it can reach and how much it is allowed to spend. Do that, and you take most of the profit out of LLMjacking.

Want help locking down your cloud accounts and AI keys? See our security hardening services or request a quote.

Get security alerts like this by email, with our free checklist, at our security alerts page.

Sources: Google Cloud Threat Intelligence: The Rise of LLMJacking; LiteLLM GitHub security advisory GHSA-wxxx-gvqv-xp7p.