THE ESSENTIALS IN 30 SECONDS

  • In incidents investigated in 2026, fraudulent model usage topped $100,000 in a single day, and cumulative charges at some victims reached about $1 million.
  • Attackers test stolen keys with minimal requests capped at one output token, enable services such as Amazon Bedrock or the Gemini API on victim accounts, and resell access through so-called LLM mixers.
  • Google recommends least privilege, secret scanning, per-model quotas and spending caps, and treating any unexpected activation of LLM services as a critical security event.

Google Threat Intelligence Group (GTIG) and Mandiant published a report on November 2 describing how criminals hijack companies' access to large language models and leave the victims to pay the bill. The practice, known as LLMjacking, was described by Sysdig researchers as early as 2024; they estimated that an undetected attack could cost more than $46,000 a day. Google's figures are higher: in individual incidents, fraudulent charges exceeded $100,000 in one day, and some organizations accumulated around $1 million before access was cut off.

How the attacks work

According to the report, stolen cloud identity material is the main way in: IAM credentials, service account keys, GitHub personal access tokens and session tokens, along with API keys left in public code repositories.

Attackers then check which keys work with tiny requests limited to a single output token, a volume low enough to escape anomaly alerts. Google says that in several cases the victims had not even enabled AI services: the intruders switched on Amazon Bedrock or the Gemini API themselves, and large bills followed within hours.

The report also cites a LiteLLM vulnerability, CVE-2026-40217, as a privilege escalation route. The public CVE record, published in April, describes it as a remote code execution flaw in a guardrail-testing endpoint, rated 8.8 out of 10; Google urges rapid patching of LiteLLM and similar gateways.

A resale market

Much of the stolen access ends up in "LLM mixers", gateways that pool compromised keys, meter usage and hide where requests come from. Google says one service, Jet Night, made more than 500,000 API calls in under eight hours using stolen keys and offered unlimited tokens for about $60 a month. Incidents this year hit financial services, retail, technology and transportation firms in North America, South America and Asia-Pacific.

Recommended defenses

GTIG advises centralized secret management with automatic rotation, least-privilege permissions that explicitly deny unneeded AI services, automated secret scanning of code repositories, per-model quotas and spending caps, and phishing-resistant MFA. It also suggests watching logs for low-volume probes and enabling data access audit logs, which are off by default on Google Cloud. Above all, it says any unauthorized activation of an LLM service should be handled as a critical incident.