LLMjacking: How Stolen AI API Keys Run Up Cloud Bills

LLMjacking is the theft of a business’s AI access, and Google’s threat intelligence team says it has cost some victims more than US$100,000 in a single day. In a report dated 3 November, Google Threat Intelligence Group (GTIG) and Mandiant describe criminals using stolen cloud credentials and AI API keys to run expensive models on someone else’s account, then reselling that access to other criminals. Victims in the Asia Pacific were among those hit. If your business has connected ChatGPT, Claude, Gemini or any other model to its systems, here is what Google found and what to lock down this week.

What Google found about LLMjacking

According to Google’s LLMjacking report, Mandiant responded to multiple incidents in 2026 in which attackers hijacked enterprise access to large language models. The intrusions spanned several cloud and AI providers and affected organisations in North America, South America and the Asia Pacific, across financial services, retail, technology and transportation.

Unlike cryptojacking, which tends to drain resources slowly, Google says LLMjacking can create large spikes in cloud charges within hours. It observed fraudulent charges above US$100,000 in a single day in individual incidents, and cumulative charges of up to US$1 million at some organisations before access was revoked. In one case, an attacker made more than 500,000 API calls in under eight hours.

A key detail for business owners: in several incidents, the AI services were not even switched on when the attacker arrived. Stolen access keys were used to enable services such as Amazon Bedrock or the Gemini API, and the bills followed. You can be exposed to LLMjacking without ever having used AI in that cloud account.

How attackers get your AI API keys

Google says the dominant way in has been exposed or stolen cloud identity credentials, not clever attacks on the AI model itself. The report lists:

• Cloud credentials and service account keys, including one misconfigured service account key that gave an attacker a foothold and then access to a model API.
• GitHub personal access tokens used to read private code repositories and hunt for hard-coded secrets.
• AI API keys left in public code. One group harvested corporate LLM keys from public GitHub repositories and tested each one with a tiny single-token request so the checks would not trigger volume alerts.
• Session token theft. A fake portal tricked users into pasting an active access token, which let the attacker bypass passwords and multi-factor authentication.
• Exposed self-hosted models. Attackers also scan for publicly reachable model endpoints, such as unprotected Ollama servers, and run their own models on them.

Once inside, attackers searched code, logs, databases and secret managers for more credentials, created backdoor accounts (one disguised as a billing optimisation tool) and, in one case, exploited a vulnerability in the LiteLLM gateway (CVE-2026-40217) to turn ordinary keys into full admin credentials.

LLM Mixers: who ends up using your account

The newer part of the story is what Google calls “LLM Mixers”: illicit gateways that pool stolen keys, meter usage and resell cheap AI access to underground subscribers. As The Register reports, one such service offered an “unlimited” plan for about US$60 a month with alleged access to frontier models, which Google believes is only profitable because the victim pays for the tokens. The Hacker News also notes separate Symantec research into a grey-market relay that reconfigures genuine AI coding tools to route requests through third-party servers with sandboxing switched off.

Google expects criminals to increasingly prefer LLMjacking over cryptojacking, and to target exposed API tokens and model routing middleware as more businesses put higher-tier models and agents into production.

Why Australian businesses using AI should care

Many Australian businesses that use AI do so through API keys: a chatbot on the website, an AI agent that reads email, or AI integrations into a CRM or accounting system. Each of those keys is effectively a credit card number for your cloud account. If it sits in a code repository, a shared spreadsheet or a contractor’s laptop, it can be found.

The Australian Cyber Security Centre co-authored guidance on deploying AI systems securely, which calls for authentication and authorisation on exposed APIs, phishing-resistant MFA, least-privilege access, credential management and logging of AI inputs, outputs and errors. Cyber.gov.au’s guidance on the careful adoption of agentic AI warns that agents hold secrets like API keys and recommends replacing static, long-lived secrets with short-lived credentials. That fits with the oversight and dependency questions in the DTA’s AI Reference Architecture.

A practical checklist to stop LLMjacking

Drawing on the mitigations in Google’s report and the ACSC-backed guidance, these are the steps worth doing now:

1. Set spending caps and budget alerts. Google recommends granular API quotas per model and spending limits. It limits how much damage a single stolen key can do.
2. Get keys out of code. Use a secrets manager, rotate keys automatically and turn on secret scanning in GitHub or GitLab so any key committed to source code is caught and removed.
3. Scope every key. Separate keys by environment (development and production) and by model, so a key for a cheap utility model can’t call an expensive frontier model.
4. Apply least privilege. Deny access to cloud AI services for any user or service account that doesn’t need it, and alert when an AI service is enabled unexpectedly.
5. Enforce phishing-resistant MFA on cloud consoles, identity providers and developer platforms.
6. Watch the logs. Google suggests monitoring gateway logs for tiny validation requests such as max_tokens=1, and treating any attempt to switch off model invocation logging as high severity.
7. Patch your AI plumbing. Include model gateways like LiteLLM in vulnerability management, just as you would with any internet-facing server (see our post on the PHP2Shell vulnerability).
8. Never expose self-hosted models publicly. If you run a local LLM for business or one of the private LLM options, keep it behind authentication and a firewall.

If you are building new AI tools, design key handling in from the start. That is part of any sound custom AI development project, and our free MCP course covers connecting AI tools to business systems safely.

This is general information based on Google Threat Intelligence Group’s report of 3 November 2026, published media reporting and Australian Cyber Security Centre guidance as at 4 November 2026. It is not security, legal or financial advice. Dollar figures are as reported by Google in US dollars. If you suspect a key has been exposed, revoke and rotate it with your provider immediately and review your usage and billing.

Related reading: For a practical map of which tools need keys, spend caps and monitoring, see our guide to the best AI tools for Australian small business. The free Start Smarter course covers what never to paste into a public AI tool.

Featured image: Photo by Alena Darmel on Pexels.