LLMjacking Ran Up $1 Million in AI Bills, on Models Some Victims Had Never Switched On

Most security teams think of their AI exposure in terms of what goes into the model: prompts, documents, customer data. The newest abuse ignores all of that. Attackers are taking over the cloud accounts that pay for the models, switching on AI services the company never used, and selling the capacity to strangers at a steep discount. Nothing is stolen in the usual sense. The victim simply receives an invoice that can climb faster than any cryptojacking bill ever did.

A Bill That Grows by the Hour

Google Threat Intelligence Group and Mandiant published their findings on November 2 after responding to multiple incidents during 2026 in which attackers hijacked enterprise access to large language models. Victims were in North America, South America and Asia Pacific, in financial services, retail, technology and transportation. Across individual incidents, Google observed fraudulent charges exceeding $100,000 in a single day, and cumulative charges at some organizations reached $1 million before access was revoked. Unlike the slow drip of cryptojacking, the researchers wrote, this kind of abuse "can generate large spikes in fraudulent cloud charges in a matter of hours."

The volumes explain the speed. One actor executed more than 500,000 LLM API calls in under eight hours. BleepingComputer reported that once access is resold, request volumes can jump suddenly, sometimes past 1,000 requests per second. A cluster Google tracks as UNC6993 ran up more than $100,000 in charges after breaking into a cloud instance through a misconfigured service account key and generating additional API keys.

The most telling detail is what was not there before the attack. "In multiple incidents that Mandiant investigated, LLM services were not enabled at the time of compromise," the report says. The attackers enabled managed generative AI services themselves, created new API keys and, in some cases, subscribed the victim's account to pay-as-you-go agreements. A company that has never approved an AI project can still receive an AI bill, which is why Google advises treating any unauthorized enablement of an LLM service as a critical security event.

Stolen Keys, Resold for $60 a Month

The way in is rarely exotic. Exposed or stolen cloud identity tokens were the dominant entry point: IAM credentials, service account keys, GitHub personal access tokens and live session tokens. Other actors harvested LLM API keys from public GitHub repositories or probed for exposed Ollama endpoints. UNC6993 also ran a fake application portal that persuaded users to paste a raw JSON payload containing an active access token, which let it bypass both the password and MFA. Once inside, the intruders cloned repositories to hunt for hardcoded secrets, minted credentials for high-privilege service accounts and created backdoor accounts disguised as billing utilities.

Some of the techniques are designed to stay below the alarms. Actors ran validation sweeps with a max_tokens setting of 1, confirming stolen keys still worked while staying under EDR and SIEM volume alerts. One used a "burn and rotate" pattern of short-lived service accounts to slip past rate limits while watching the billing. Another cluster bought pre-validated keys and exploited CVE-2026-40217 in the LiteLLM gateway to raise ordinary virtual keys to administrator. Obsidian Security, which reported the flaw chain to LiteLLM's maintainers on February 19, rates the chain 9.9 and says v1.83.14-stable, released April 25, was the first version with the complete fix set.

The stolen access then moves down a supply chain of its own. Google describes "LLM mixers" that pool hijacked keys and resell model access to subscribers. One, Jet Night, offered an unlimited plan for about $60 a month, against typical consumer rates of $100 to $250, and passed nearly $1 million in token costs to a single victim. A separate grey market is aimed at the endpoint. Symantec's Threat Hunter Team reported on October 29 that an unauthorized relay service installs the genuine Codex and Claude Code tools, then reroutes every request through its own servers, sets Codex's sandbox to "danger-full-access" and switches off telemetry. It has touched about a dozen organizations, mostly in mainland China, and Symantec has not seen the operator abuse its access, but the design would let it read every prompt and secret the agent handles.

Treat AI Spend as a Security Signal

LLMjacking sits in a gap between two teams. Finance sees the bill weeks later; security watches for data leaving, not compute arriving. Google's own guidance closes that gap from both ends:

• Deny AI services by default. Google recommends denying every permission not explicitly required, including access to cloud LLM services, so a stolen credential cannot switch on a model nobody approved.
• Alert on enablement, not just usage. Watch for new AI service activations, new API keys and changes to model logging. On Google Cloud, inference calls appear in Data Access logs, which are disabled by default and must be turned on.
• Cap the spend. Set budget alerts, spending caps and per-model quotas. A $100,000 day is only possible when nothing stops the meter after the first hour.
• Shorten credential lifetimes. Move service account keys and API keys into a central secrets manager with automatic rotation, scope keys by model and environment, and scan repositories for exposed secrets.
• Patch the gateway layer. If LiteLLM or a similar proxy sits in front of your models, confirm it runs v1.83.14-stable or later and audit its admin accounts, since a single gateway flaw turned ordinary keys into full control.
• Find the unofficial AI tools. Look for AI coding assistants pointed at unapproved endpoints, with sandboxing disabled or telemetry switched off, especially where staff installed them through an unofficial reseller.

For two years, the question most boards asked about generative AI was how much the company should spend on it. Google's findings add a second question that belongs to the security team: how much is someone else spending on it, under your name. Any organization with a cloud account can answer that today by checking which AI services are enabled, who can enable them, and whether anyone would notice a bill that doubled before lunch.