GoKawiilGoogle reports LLMjacking attacks have cost victims up to $1 million in cloud AI charges
Google's Threat Intelligence Group and Mandiant found that attackers are stealing API keys and exploiting exposed LLM endpoints to resell unauthorized access through services called LLM mixers. Victim organizations have seen fraudulent usage spike past 1,000 requests per second, with some racking up over $100,000 in charges in a single day and cumulative losses reaching $1 million. One service, Jet Night, reportedly passed nearly $1 million in token costs to a single victim after executing more than 500,000 API calls in under eight hours.
GoKawiil's interpretation of the reporting above, not reported fact.
The findings suggest a maturing underground economy built specifically around monetizing stolen cloud AI credentials, with dedicated resale infrastructure rather than opportunistic one-off theft. Because cloud providers bill based on recorded usage regardless of who initiated it, companies may be left responsible for six-figure bills caused by compromised keys, which could push enterprises to tighten API key management and monitoring. This pattern may also signal that AI infrastructure is becoming a prime target as adoption grows.
- Stolen or exposed API keys are being resold through 'LLM mixer' services for unauthorized AI access.
- Some victim organizations have incurred over $100,000 in fraudulent charges in a single day, totaling up to $1 million.
- Services like Jet Night advertise 'unlimited access plans' for as little as $60/month using hijacked infrastructure.
Source: bleepingcomputer.com, 2026-11-03
Published there as: “Google: LLMjacking attacks rack up $1 million in cloud AI charges”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.