LLMjacking: Stolen AI Keys Run Up Cloud Bills

On November 2, 2026, Google Threat Intelligence Group and Mandiant described "LLMjacking": stealing access to cloud AI models and using it on someone else's bill. Google says some incidents topped $100,000 in a single day and up to $1 million in total. It matters to any business or website that pays for an AI API.

What we know

What it is: according to Google's post, attackers take over a company's access to large language models in the cloud and use or resell it. The legitimate account owner gets the bill.
Why it's different: Google contrasts it with cryptojacking, which burns resources gradually. With LLMjacking, it says, fraudulent charges can spike within hours.
How much: Google reports incidents with more than $100,000 in charges in a single day, and organizations that piled up as much as $1 million before access was revoked. In another case, an attacker made more than 500,000 model calls in under eight hours with stolen keys to power a resale service.
How they get in: Google says the most common entry point across several investigations was exposed or stolen cloud credentials: service account keys, IAM credentials, GitHub personal access tokens and session tokens. It also mentions LLM API keys harvested from public GitHub repositories and model servers left open to the internet.
Who profits: Google describes "LLM Mixers", services that pool stolen access and resell it by subscription. Its example is Jet Night, with an unlimited-token plan of about $60 a month.
Where: Google places victims in North America, South America and Asia-Pacific, across financial services, retail, technology and transportation.
A specific flaw: the post cites CVE-2026-40217 in LiteLLM, a gateway that routes requests across models. According to Google, it let an ordinary key be turned into a full admin key. It urges teams to include such gateways in routine patching.

What changes and what doesn't

What changes is how fast damage turns into money. A stolen AI key is no longer just a privacy issue: there is a market for it, and it can be spent within hours.
What changes is the value of an unrestricted key. A key that can call any model, including the most expensive ones, is the most useful to an attacker. Google recommends scoping keys so one meant for a cheap model can't call premium ones.
What doesn't change is the root cause. This isn't a flaw in OpenAI, Gemini or Claude: access is stolen outside the model, through credentials that were stored or exposed carelessly.
There is no public count of affected companies. The dollar figures come from cases Google investigated, not an average.

How to tell if it affects you

If your website or business uses an AI model API key (a chatbot on your site, a WordPress plugin or Drupal module that writes copy, an automation that calls the API), check this today:

See where the key lives. A key shipped in your page's JavaScript can be read by any visitor in their browser. It belongs on the server only. If your chatbot calls the model straight from the page, ask whoever set it up how it works.
Search your repositories. If your site's code is on GitHub or GitLab, make sure the key isn't in any file or in the commit history. Both platforms offer secret scanning.
Set a spending cap. In your AI provider's or cloud console, set a monthly limit and a usage alert. Google lists per-model quotas and spending caps among its defenses.
One key per job. Keep separate keys for the chatbot, for testing and for other automations, each limited to the model it needs. If one leaks, you revoke just that one.
Rotate old keys. If a key hasn't changed in months, or has been shared over email, chat or screenshots, create a new one, swap it in and delete the old one.
Watch for odd usage. Google describes one group that validated stolen keys with minimal single-token requests, and recommends watching logs for that pattern. A burst of tiny calls in your usage log is worth a look.

Sources

Updates: if Google or AI providers publish scope figures or change their default spending limits, it will be added here with a link.