LLMjacking attacks are driving up cloud AI bills by abusing exposed Large language model (LLM) services and stolen API keys, according to researchers at Google’s Threat Intelligence Group (GTIG) and Mandiant. In incidents they analyzed, some organizations accumulated fraudulent charges of up to $1 million, while daily costs in some cases exceeded $100,000.

The researchers identified two broad approaches: scanning for publicly exposed LLM endpoints and stealing valid API keys from inadequately protected machines. Attackers can then sell access to services known as LLM mixers, which route customers’ prompts through hijacked infrastructure. The cloud provider records the resulting requests as legitimate use and bills the affected organization.

Usage can surge rapidly after access is resold, with request rates sometimes topping 1,000 per second. Google cited a threat actor that made more than 500,000 LLM API calls in under eight hours using stolen third-party keys through the Jet Night routing service. The operation passed nearly $1 million in token costs to the victim organization, the researchers said. Jet Night advertises unlimited access plans for $60 a month; Google also identified the newapi[.]pro service.

Google further identified the threat cluster UNC6993, which appears to aggregate stolen keys with gateway tools and may sell access through underground forums. Attackers have obtained access through exposed or compromised cloud credentials, service-account keys, GitHub tokens, active session tokens, and LLM API keys. They may search environments for additional secrets and attempt to maintain access by creating backdoor accounts or adding SSH keys.

The researchers also observed exploitation of CVE-2026-40217, a LiteLLM vulnerability that can allow arbitrary code execution on a server through its custom-code guardrail testing endpoint. In some cases, attackers used victims’ cloud infrastructure to host unauthorized proxy endpoints and agent-based workloads.

Google recommends tightening identity and access controls, using centralized systems to manage and rotate secrets, and limiting permissions to those required for each role. It also advises organizations to enforce phishing-resistant multifactor authentication, set API usage and spending limits, and monitor cloud audit and inference logs for unusual activity, unauthorized AI services, suspicious credential checks, or attempts to disable logging.

Sources: BleepingComputer.