Attackers who steal an enterprise's access to large language models can run up more than 100,000 dollars in fraudulent cloud charges in a single day, and cumulative charges at some organizations have reached 1 million dollars before the access was revoked, Google warned on Monday.
The warning came in a report titled "The Rise of LLMJacking" from Google Threat Intelligence Group and Mandiant, based on incidents the firms responded to in 2026. LLMjacking is resource hijacking adapted for the AI era: an attacker obtains a valid API key or cloud credential, uses the victim's LLM accounts and quotas, and leaves the owner to pay.
Google stressed that speed sets this crime apart. Unlike cryptojacking, which consumes resources gradually, LLMjacking can generate large spikes within hours, because frontier models and GPU-backed inference are expensive and can be called at machine speed once a key is in hand.
The most common way in, the report found, was exposed or stolen cloud identity tokens. That includes IAM credentials, service account keys, GitHub personal access tokens and active session tokens. Other intrusions began with API keys taken from public GitHub repositories, compromised IAM credentials used to generate fresh keys that bypass multi-factor authentication, and a hacked service account key with broad permissions.
One group Google tracks as UNC6993 illustrates how far a single mistake can go. The group breached a cloud instance through a misconfigured service account key and used that foothold to reach an LLM API. It also hosted a fake portal that tricked visitors into pasting a raw JSON payload containing an active access token, which was then used to bypass password and multi-factor controls. Inside victim projects, UNC6993 created additional API keys and racked up more than 100,000 dollars in charges, using tools including new-api and gcli2api to pool stolen keys.
Once inside, attackers did far more than call a model. Google described privilege escalation, reconnaissance across cloud regions, cloning repositories to hunt for hard-coded secrets, scanning logs for other credentials, harvesting passwords from secret managers, and creating backdoor service accounts, in one case disguised as a billing utility. In another case, attackers exploited CVE-2026-40217 in the LiteLLM routing software to turn ordinary virtual keys into master administrator credentials for a victim's gateway.
The end goal is resale. Google described a new layer of the underground economy it calls LLM Mixers: illicit routing gateways that aggregate stolen keys, proxy requests through them, and resell access through underground storefronts. One service, Jet Night, offers an unlimited token plan with alleged access to a frontier model for about 60 dollars a month, a level Google noted would typically cost 100 to 250 dollars legitimately. An actor feeding Jet Night with stolen third-party keys made more than 500,000 LLM API calls in under eight hours, passing nearly 1 million dollars in token costs to the victim. Jet Night has also announced outages that Google believes were caused by victims discovering compromises and revoking keys.
The incidents spanned financial services, retail, technology and transportation in North America, South America and Asia Pacific, across multiple cloud and model providers. Google expects attackers to prioritize LLMjacking over traditional resource theft as enterprises put higher-tier models and agentic workflows into production, refining automated searches for exposed tokens and flaws in model-routing middleware.
For enterprise teams, the lesson is familiar but urgent: scope and cap every key, keep credentials out of code repositories, watch cloud audit logs for sudden LLM service enablement and invocation spikes, and rotate anything that may ever have been exposed.