Artificial Intelligence

Google Warns LLMjacking Attacks Drive Up $1 Million in Cloud AI Costs

Researchers from Google's Threat Intelligence Group and Mandiant have reported that large language model hijacking attacks are generating massive fraudulent cloud charges, with some organizations sustaining losses surpassing $100,000 per day.

Radwan AbdulhadiEditor and technology writer

Published: November 4, 2026 · Updated: November 4, 2026 · 4 min read

Google Warns LLMjacking Attacks Drive Up $1 Million in Cloud AI Costs — Image: BleepingComputer

The Rising Threat of LLMjacking

Large language model hijacking attacks, widely referred to as LLMjacking, are causing severe financial impacts through unauthorized and fraudulent cloud charges. According to analyzed incidents from researchers at Google's Threat Intelligence Group (GTIG) and Mandiant, individual organizations have recorded costs scaling as high as $1 million due to fraudulent calls executed using stolen API keys. Detailed insights on these campaigns were published by <a href="https://cloud.google.com/blog/topics/threat-intelligence/llmjacking-monetizing-compromised-cloud-models">Google says</a> in recent threat analysis reports. Further details are available from BleepingComputer in the original source material.

Investigators have identified two primary categories of threat actors involved in these operations: individuals who systematically scan for publicly exposed large language model endpoints, and adversaries who steal valid API keys directly from unprotected machines. Once initial access is established, the attackers transfer or sell control to secondary services known as LLM mixers. These services subsequently provide their own subscribers with unauthorized access to victim enterprise artificial intelligence infrastructure.

LLMjacking usage spike Source: Google · Source: BleepingComputer

Exploitation Techniques and Reselling Infrastructure

After the access is resold, request volumes can experience sudden and severe spikes, occasionally exceeding 1,000 requests per second. Cloud service providers log these high-frequency inputs as legitimate consumption, billing the victim organization directly for the consumed tokens. LLM mixers sustain this cycle by offering access to AI resources at extremely low subscription prices, utilizing proxy infrastructure to route consumer prompts through stolen API keys.

Researchers have documented multiple examples of this relaying infrastructure. Among them is Jet Night, which has offered unlimited access plans for roughly $60 a month, alongside platforms like newapi[.]pro. As highlighted by <a href="https://www.bleepingcomputer.com/news/security/google-llmjacking-attacks-rack-up-1-million-in-cloud-ai-charges">BleepingComputer</a>, a specific threat actor leveraged stolen third-party API keys to drive the token routing service jet-night.com, executing over 500,000 API calls in under eight hours and passing nearly $1 million in token costs onto the victim.

In addition to Jet Night, security analysts identified the threat cluster designated as UNC6993. This cluster utilizes specialized gateway tools to aggregate stolen credentials and distribute requests, frequently selling unauthorized access through underground forums.

Access Vectors and Vulnerability Exploitation

Attackers typically secure initial entry through exposed or poorly managed cloud credentials, service account keys, GitHub tokens, active session tokens, and LLM API keys. Once inside a network, malicious actors scour the compromised environment for additional credentials, logs, databases, and secret managers. They frequently attempt to establish persistence by creating backdoor accounts or injecting secure shell (SSH) keys.

Furthermore, researchers observed threat actors actively exploiting software vulnerabilities, notably CVE-2026-40217. This specific security flaw affects LiteLLM and enables arbitrary code execution on targeted servers by abusing the custom-code guardrail testing endpoint. In certain instances, attackers utilized the compromised cloud infrastructure itself to host unauthorized proxy endpoints and agentic workloads.

For example, investigators noted a threat actor who deployed publicly accessible reverse proxies and custom Node.js proxy bundles to expose endpoints compatible with multiple frontier large language models under the persona known as D1337-KAIROS.

Jet Night pricing plans Source: Google · Source: BleepingComputer

Recommended Defense and Mitigation Strategies

To combat the escalating threat of LLMjacking, Google recommends that organizations enforce strict security baselines, starting with prioritizing robust Identity and Access Management (IAM) and securing the software supply chain. Companies should deploy centralized secrets platforms capable of automating the management and rotation of sensitive keys.

Security teams should adhere to the principle of least privilege, ensuring users and applications lack extended permissions unless explicitly required. Administrators should explicitly deny all permissions not necessary for normal operations, including access to cloud large language model services. Additionally, enforcing phishing-resistant multi-factor authentication (MFA) helps block initial credential theft.

Organizations should also deploy monitoring tools to maintain comprehensive visibility across their environments, helping detect unauthorized AI services and shadow AI usage. Establishing strict API usage and spending limits allows companies to catch LLMjacking attempts early and limit financial damage. Finally, cloud audit and inference logs must remain enabled and actively monitored to catch unusual usage patterns, suspicious credential checks, and attempts to disable logging mechanisms.