Google says LLMjacking runs up $100,000 a day in stolen AI usage

On 2 November 2026, Google Threat Intelligence Group (GTIG) published The Rise of LLMJacking, a report on attackers who take over a company's paid access to large language models and run it at the company's expense. Google says Mandiant, its incident response unit, worked on several such cases in 2026, across cloud and model providers, in financial services, retail, technology and transportation, in North America, South America and Asia Pacific.

Google writes that it saw fraudulent charges above $100,000 in a single day in individual incidents, and cumulative charges at some organizations reaching $1 million before access was revoked. BleepingComputer covered the report on 3 November with the same figures.

Faster than cryptojacking

GTIG compares LLMJacking to cryptojacking, where stolen servers mine coins slowly in the background. The difference, according to the report, is speed: hijacked model access can produce large spikes in charges in a matter of hours. In several cases Mandiant investigated, the victim had not even turned on the AI services. The attackers used stolen access keys to enable services such as Bedrock or the Gemini API themselves, then ran up the bill in minutes or hours.

How they get in

Some attackers look for model endpoints left open on the internet. The report shows one testing exposed Ollama servers and trying to register its own models on them.

Google says the most common way in is stolen or exposed cloud credentials: IAM credentials, service account keys, GitHub personal access tokens and active session tokens. One cluster, which GTIG tracks as UNC6993, broke into a cloud instance through a misconfigured service account key. It also ran a fake portal that told users to paste a raw JSON payload containing a live access token, which let it skip passwords and multi-factor authentication.

Model API keys are a target on their own. GTIG describes a group that collected corporate LLM API keys from public GitHub repositories, then checked which ones still worked with requests capped at a single token (max_tokens=1). Requests that small stayed under the volume alerts of the victims' security tools.

Once inside, the report says, attackers searched code repositories, logs, databases and secret managers for more credentials, created backdoor accounts and injected SSH keys. One follow-on group exploited a flaw in the LiteLLM gateway, CVE-2026-40217, to turn ordinary virtual keys into full admin credentials.

The resale market

The report then follows the money. GTIG describes "LLM Mixers": services that pool stolen keys, meter usage, hide where requests come from and sell the access to subscribers. UNC6993 used open-source gateways such as new-api and gcli2api to spread requests across accounts, and Google believes it sells access through underground storefronts.

The clearest case is a token routing service called Jet Night. According to GTIG, an actor made more than 500,000 LLM API calls in under eight hours with stolen third-party keys to power it, and Jet Night passed nearly $1 million in token costs to the victim. Jet Night advertised an unlimited plan for about $60 a month with alleged access to frontier models. Google notes that a comparable consumer plan usually costs $100 to $250 a month, and says the service has posted several outages on its Telegram channel, likely as victims find and revoke the keys. GTIG lists jet-night.com and newapi.pro as indicators of compromise.

GTIG expects attackers to favour LLMJacking over cryptojacking as companies put more expensive models and agents into production.

What Google tells teams to do

The mitigation list in the report is long. The items that apply to almost anyone paying for AI usage:

• Keep keys in a secrets manager and rotate them automatically.
• Turn on secret scanning in GitHub or GitLab so a committed key is caught and removed.
• Deny access to cloud LLM services to any account that does not need it.
• Set per-model API quotas and spending caps.
• Scope keys by model, environment and usage limit, so a key for a cheap model cannot call an expensive one.
• Watch gateway logs for tiny requests such as max_tokens=1, which often come before large-scale abuse.
• Patch model gateways such as LiteLLM, and enforce phishing-resistant multi-factor authentication.

Google also says enabling an AI service should itself be treated as a critical security event when nobody on the team asked for it.

Why it matters beyond security teams

An AI API key often sits in a side project, a no-code tool or a repository an agent wrote. The report describes what happens when such a key leaks: someone else's traffic runs on your account, and the invoice arrives in hours, not months. A spending cap on the provider's dashboard is the cheapest item on Google's list, and it is the one that limits the damage when everything else has failed.