High
LLMjacking, LLM security, API keys, leaked secrets, cloud security, Google Threat Intelligence, Mandiant, UNC6993, LiteLLM, AI security
LLMjacking: Stolen Cloud Keys Run Up $1M in AI Charges
LLMjacking uses stolen cloud keys and LLM API tokens to run up AI bills, $100,000 a day in some cases, per Google. How it works and how to stop it.
LLMjacking is an attack where criminals steal an organization's cloud credentials or LLM API keys and use its AI model access for themselves, leaving the victim with the bill. Google Threat Intelligence Group and Mandiant say they have seen fraudulent charges above $100,000 in a single day and cumulative charges reaching $1 million at some organizations before access was revoked. The most common way in is an exposed or stolen cloud identity token.
Google's report on LLMjacking describes it as resource hijacking adapted for AI. Where cryptojacking drains compute slowly, LLMjacking "can generate large spikes in fraudulent cloud charges in a matter of hours," the researchers wrote. Victims span financial services, retail, technology and transportation across North America, South America and Asia Pacific, according to The Hacker News.
The initial access is familiar. Attackers used exposed or stolen IAM credentials, service account keys, GitHub personal access tokens and active session tokens. One actor Google tracks as UNC6993 breached a cloud instance through a misconfigured service account key, then created more API keys inside victim projects and ran up more than $100,000 in charges. It also hosted a fake portal that tricked users into pasting a raw JSON payload containing an active access token, which let it skip passwords and MFA. In another case, a stolen GitHub token gave an attacker access to private repositories. Google also lists LLM API keys pulled from public GitHub repositories and exploitation of LLM routing software, including a LiteLLM privilege-escalation flaw, CVE-2026-40217. OWASP tracks the cost side of this risk as LLM10: Unbounded Consumption.
How do attackers make money from LLMjacking?
Google says the goal is to monetize foundation-model access through token proxying, automated model streaming and GPU provisioning. A new category it calls LLM Mixers resells stolen access through underground storefronts; one service advertised an unlimited token plan for roughly $60 a month. Once inside, actors cloned codebases to hunt for hard-coded secrets, pulled credentials from cloud secret managers, created backdoor service accounts disguised as billing utilities, and used a "burn and rotate" pattern of short-lived service accounts to dodge rate limits. Separately, Symantec reported a grey-market relay that installs the genuine Codex and Claude Code CLIs, then rewrites their config files to turn the sandbox off and route every request through its own servers.
How do you detect and prevent LLMjacking?
Control | What it stops | Where to start |
|---|---|---|
Secret scanning on every commit and repo history | API keys and tokens leaked in code | Block pushes that contain keys; scan existing history |
Short-lived credentials, no long-lived service account keys | Stolen keys that work for months | Workload identity federation instead of key files |
Budget alerts and per-project quotas on AI services | Bills that spike in hours | Alert on hourly spend, not monthly totals |
Audit new API keys and service accounts | Attackers minting their own access | Alert on key creation outside your deploy pipeline |
Patch LLM gateways and routing middleware | Privilege escalation through proxies | Track LiteLLM and similar tools like any internet-facing app |
Approved AI tool installs only | Relays that rewrite CLI configs | Check ~/.claude/settings.json and ~/.codex/config.toml for unknown endpoints |
For key handling, the OWASP Secrets Management Cheat Sheet covers rotation and storage. The fastest signal is cost. Google's data shows damage accumulates within hours, so a monthly billing review is too slow. Pair hourly spend alerts on AI services with alerts on new keys and service accounts, and you will usually see LLMjacking before the invoice does.
Our read
Nothing here is a new class of attack. It is the old leaked-secret problem with a far faster meter attached: a token that sat in a repo for a year used to mean a breach risk, and now it can also mean a six-figure bill by morning. The fix starts where the keys leak, in code, commit history and CI configuration, before they ever reach a public repository or a cloned codebase. Scanning every pull request for secrets, and knowing which leaked keys are still live, turns this from an incident into a non-event. For a practical starting point, see how to find hard-coded secrets in code, AI agent and LLM security risks in 2026, and our coverage of the leaked LiteLLM master key. ARGUS checks every pull request for leaked secrets and shows whether each one is live, rotated or a test value; see how ARGUS works.
Reporting by The Hacker News; research by Google Threat Intelligence Group and Mandiant and Symantec.