They Stole Your AI Keys. You Paid the Million.

Your AI bill arrived a million dollars heavy, and nobody in your company ran a single extra prompt. That is the new shape of cloud theft. Google’s Threat Intelligence Group and Mandiant warned this week that criminals are stealing enterprise access to large language models, running up enormous bills on someone else’s account, and reselling the access as a subscription service. The tactic has a name now: LLMjacking.

The numbers are what set this apart from the resource theft security teams already know. In individual incidents, Google observed fraudulent charges of more than $100,000 in a single day, and cumulative charges at some organizations reached $1 million before access was revoked. Unlike cryptojacking, which drains computing power gradually, LLMjacking can spike charges within hours — a stolen key can fire off half a million calls before lunch.

How the keys get stolen

The attackers rarely hack the AI itself. They steal the ordinary credentials that guard it. According to the report, published November 2, the most common way in has been exposed or stolen cloud identity tokens: IAM credentials, service account keys, GitHub personal access tokens, and active session tokens. From there, the AI services are just another resource to spend.

One cluster Google tracks as UNC6993 broke into a cloud instance through a misconfigured service account key, then used that access to reach an LLM API. The same group hosted a session-hijacking page disguised as an application portal, tricking people into pasting in a raw JSON payload containing an active access token — bypassing password and multi-factor authentication entirely.

Other routes in include compromised IAM credentials used to generate fresh access keys that sidestep MFA, a hacked cloud service account key with broad project permissions, and LLM API keys harvested from public GitHub repositories. In at least one case, attackers exploited a vulnerability in LiteLLM, an open-source gateway used to route requests to AI models, tracked as CVE-2026-40217, to escalate privileges once inside.

What they do once they are in

Getting in is only the start. Once inside, the intruders move fast: enumerating cloud services, code repositories, and data stores for more credentials; cloning codebases to search for hard-coded secrets; and harvesting credentials from access logs and database queries. They also dig in, abusing token-creation privileges to mint temporary credentials for high-privilege service accounts and pulling infrastructure credentials and database passwords from cloud secret managers.

It is the same stolen-identity playbook that walked into Microsoft 365 as the organizations’ own app registrations — the apps signed them in, and the audit log recorded a perfectly ordinary event. LLMjacking is what happens when that playbook meets a pay-as-you-go AI bill.

The resale machine

What turns this from theft into an industry is the middleman layer Google calls LLM Mixers: illicit routing gateways that proxy, aggregate, and resell unauthorized LLM access to other criminals through underground storefronts. One side of the operation steals the access; the other side sells it. The division of labor is why Google expects the problem to grow.

The clearest example is a service called Jet Night, which offers an unlimited token plan with claimed access to a frontier model for about $60 a month. In one case, an actor using stolen third-party API keys made more than 500,000 LLM API calls in under eight hours to power the service, passing nearly $1 million in token costs to the victim organization. The subscriber pays $60; the victim pays the million.

Why this is about to get worse

Google’s warning is blunt: threat actors will increasingly prioritize LLMjacking over traditional resource theft like cryptojacking, driven by the immediate, high-margin monetization the underground mixers enable. The victims so far span financial services, retail, technology, and transportation across North America, South America, and Asia Pacific — but the pattern is not sector-specific; it is spend-specific. Any organization whose AI usage is billed by consumption, and whose keys live in code, config files, or shared vaults, is in the blast radius.

What to do now

• Inventory every AI and cloud key. List all LLM API keys, service account keys, and tokens, who owns them, and where they are stored. Anything hard-coded in a repository or sitting in a shared config file goes to the top of the rotation list.
• Put a tripwire on the bill. Set billing alerts and hard spend quotas per project, not just per account. Alert on usage more than double the baseline within an hour, on new API keys being created, and on new service accounts appearing.
• Lock down token creation. The privilege to mint new service account keys is the privilege that turns one stolen credential into a persistent foothold. Restrict it to the smallest set of identities that need it, and alert every time it is used.
• Scan for leaked keys, then revoke. Run secret scanning across GitHub and internal repositories, and treat anything found as already stolen: rotate it first, then clean it up. Check AI coding tools for rewritten endpoints or relay-issued tokens, and block installs from unauthorized resellers.

The uncomfortable part of LLMjacking is that nothing is broken. The API key worked. The model answered. The bill was correct. The only thing wrong was whose money it was. And the models themselves are only getting more powerful — the same week, an AI system found 81 previously unknown Firefox flaws and built working exploits for hundreds of Linux kernel bugs. The keys that pay for them are the soft target.