Google warns hackers are stealing companies' AI accounts and running up bills near $1 million
Attackers resell the stolen access cheaply, a scheme Google calls LLMjacking.
Criminals are breaking into companies' cloud accounts to use their paid AI models for free, in some cases running up more than $100,000 in charges in one day, Google's threat researchers said in a report Monday.
Google Threat Intelligence Group and Mandiant, Google's incident-response unit, call it LLMjacking. An LLM, or large language model, is the technology behind chatbots like Gemini and ChatGPT. Businesses pay per use, so whoever holds a company's login or API key, a password-like code programs use, runs up the company's bill. Some organizations hit about $1 million in total charges, Google said.
Reselling the stolen access
Attackers find keys accidentally posted on public sites like GitHub, steal them from cloud accounts or exploit software flaws. They then sell access through "LLM mixers." One, Jet Night, offered unlimited use for about $60 a month, Google said, against a normal $100 to $250. One actor made more than 500,000 requests in under eight hours, costing a victim nearly $1 million.
Google urged companies to store keys securely, limit what each key can do, scan code for leaked secrets and set spending alerts and caps.
Source: Google Cloud Threat Intelligence blog, "The Rise of LLMJacking," Nov. 2, 2026