Google warns LLMjacking is running up cloud bills of $100,000 a day

What LLMjacking is

Google's threat researchers have put a name and a price tag on a category of cloud abuse. The Hacker News reported that Mandiant and the Google Threat Intelligence Group warned enterprises about LLMjacking, a form of resource hijacking adapted for large language models.

The mechanism is straightforward in principle. Rather than attacking a model, an attacker takes over someone else's access to it and spends that organisation's compute budget. The model provider bills the customer, the customer sees a spike, and the attacker gets inference capacity without paying for it.

The size of the bills

The numbers are what make the report worth reading. The Hacker News reported that some organisations were running up more than $100,000 in a single day, with cumulative charges at some reaching $1 million before access was revoked.

SiliconANGLE reported the same daily figure from the Mandiant and Google Threat Intelligence report on monetising compromised cloud and model resources, describing attackers running up fraudulent charges above $100,000 in a day.

Those amounts matter because they are not hypothetical losses on a risk register. They are invoices, and they arrive on a normal billing cycle, often after the credentials have already been used for days.

How attackers get in

The entry points are familiar to anyone who works on cloud security. The Hacker News reported that attackers look for publicly exposed LLM endpoints and for credentials including service account keys, GitHub personal access tokens and active session tokens, which give them an initial foothold.

One tracked actor, identified as UNC6993, reportedly breached a cloud instance through a misconfigured service account key and used it to reach an LLM API. Nothing about that path is specific to AI, which is the point: the model is the payload, not the vulnerability.

From chatbot tricks to backend theft

The report places LLMjacking at one end of a spectrum. The Hacker News described low-level resource theft that involves manipulating customer support chatbots to perform unauthorised tasks such as code generation, contrasted with LLMjacking, which targets backend model resources directly.

That distinction shapes the defence. Prompt-level abuse can be limited with filters and rate limits on a public interface; backend credential theft has to be stopped with identity controls, key rotation and anomaly detection on spend, which are older disciplines applied to a new cost centre.

Why AI budgets are attractive

Inference is one of the few cloud services where a modest amount of access can produce a very large bill quickly. A stolen key that can call a frontier model at scale turns into spend within hours, and the attacker does not need to exfiltrate data to profit from it.

This site has covered the cost side of that equation from the provider's perspective, including the unit economics pressure behind consumer AI limits and the first hard numbers on AI spending returns. LLMjacking is the same cost curve seen from the victim's finance department.

What enterprises can actually do

The practical controls are unglamorous: inventory every key that can reach a model endpoint, rotate them on a schedule, scope them to the minimum needed, and alert on spend anomalies rather than only on traffic anomalies.

The harder organisational step is ownership. Model access often sits with an AI team while identity and cloud spend sit with security and finance, so nobody owns the join. The report's implicit argument is that LLMjacking is a governance gap before it is a technical one.

Where this fits in the threat picture

LLMjacking is adjacent to the credential and supply-chain attacks that have dominated security reporting this year. This site covered the Northflank breach that exposed customers' AI API keys and the spread of AI-assisted infostealers, both of which describe the same commodity: usable access to AI services.

The difference with LLMjacking is that the attacker does not need to steal data or install malware to cause damage. A valid key and a demand for tokens is enough, which lowers the skill floor and raises the value of basic hygiene.

What the researchers actually saw

The report is a threat-intelligence document rather than an incident survey, so its evidence is drawn from observed campaigns rather than from a sample of victims. That matters when reading the cost figures: they describe what the researchers saw in the cases they tracked, not an average across the industry.

The practical value is in the patterns. Attackers reuse the same credential-harvesting playbook that works against any cloud account, then point it at model endpoints because the spend converts to value faster. This site has covered how quickly AI infrastructure costs escalate in the financing of compute, and the same escalation is what makes a stolen key profitable.

What is established, and what is not

Established: Mandiant and Google Threat Intelligence published a report on LLMjacking; some organisations saw fraudulent charges above $100,000 in a day and cumulative charges near $1 million before revocation; attackers use exposed LLM endpoints, service account keys, GitHub tokens and session tokens; one tracked actor breached a cloud instance through a misconfigured key. Not established: how many organisations were affected in total, and how much of the spend was recovered.

The unanswered question is whether cloud providers and model vendors will build automatic circuit breakers for anomalous model spend. Until they do, the cost of a stolen key will keep being discovered by a finance team rather than by a security tool.