Ing. Calogero Bono
Google Threat Intelligence Group and Mandiant have published a report on LLMjacking, the hijacking of corporate access to language models. According to Google, in 2026 attacks hit organizations in North America, South America and the Asia Pacific region. In a single day fraudulent charges exceeded 100,000 dollars, and at some companies the total reached 1 million before access was revoked. It matters because the victim pays, not the attacker.
A few terms before we get into the facts. LLM is a large language model, the engine behind chatbots. API key is the key that lets a program use a service. IAM refers to identity and permission management in the cloud. Service Account is a technical identity used by applications rather than people. MFA is multi-factor authentication, the second check beyond the password.
What is LLMjacking and why does it cost so much?
It is an evolution of cloud resource theft. An attacker obtains a key or access and consumes AI models while the owner pays the bill. According to the Google report, unlike cryptojacking, which consumes resources gradually, here costs can climb within hours.
TechRadar reports that costs can reach six figures in six minutes. This figure is the newspaper's summary and should be read with caution, since the report speaks of hours.
How do attackers get in?
Attackers ignore support chatbots and target the models on the backend. They look for exposed endpoints or valid API keys. According to Google, however, the most common route is exposed or stolen cloud identity tokens, such as IAM credentials, Service Account keys, personal GitHub tokens and active session tokens.
A group called UNC6993 breached a cloud instance using a misconfigured Service Account key. It then used a fake login page to get users to paste their session token, bypassing passwords and MFA. Another group harvested corporate API keys from public GitHub repositories.
What do they do once inside?
They look for more credentials, escalate privileges and stay put. According to the report, they clone code searching for secrets, read logs and create unauthorized accounts. They also insert SSH keys into virtual machines. One actor created fake service accounts disguised as internal billing optimization tools.
In one case the vulnerability CVE-2026-40217 in the LiteLLM gateway was exploited to turn ordinary keys into administrative credentials. To get around request limits, one actor used a "burn and rotate" strategy, continuously creating and deleting service accounts.
If you use Google's APIs in your projects, our Gemini API guide helps you understand where the keys live.
Who are the LLM Mixers?
They are the operators of the downstream market. According to Google, they work as illicit gateways that route, aggregate and resell unauthorized access to models. This creates a division of labor between those who break into systems and those who monetize them.
According to The Hacker News, a service called Jet Night offers an unlimited token plan with alleged access to a frontier model for about 60 dollars a month. Symantec and Carbon Black also describe a service that reinstalls the Codex and Claude Code tools, routing requests through third-party servers. It mainly affects organizations in mainland China and subsidiaries in South Korea, Taiwan and Malaysia.
Limits to know
The report describes incidents without naming the affected companies, so we cannot verify the cases. We do not know how many organizations are involved, nor how many are Italian. Google's forecasts about the growth of the phenomenon are an estimate, not a fact. In the case of the service described by Symantec, there is no evidence that prompts are collected or responses altered.
What changes for those working in digital
For those who develop or manage systems, an API key becomes a critical financial asset, on a par with a credit card. Google recommends increasing visibility over LLM platforms, prioritizing the detection of changes to accounts and services, and treating every unauthorized activation as a critical event. The principle of least privilege is also essential. Those who host applications on their own servers can rely on managed hosting with security updates, but the keys remain the responsibility of whoever creates them. What employees do also matters, since installing unauthorized tools often starts out of curiosity.
Our take
The report has one merit – it shifts the conversation from fear of AI to secrets management. Nearly everything starts from credentials left where they should not be, such as public repositories and keys with overly broad permissions. These are old mistakes, made expensive by pay-per-use services. Still, one may suspect part of the alarm also serves to sell detection tools. The advice holds up, however, and it costs little. Before adding AI features to a product, it is wise to set spending limits and billing alerts.
Frequently asked questions
What is LLMjacking?
It is the theft of access to an organization's language models. The attacker uses stolen API keys or cloud identities, and the owner pays for the usage. The term echoes cryptojacking.
How much can an attack cost?
According to Google, over 100,000 dollars in a single day. At some organizations the total reached 1 million before access was revoked.
How do attackers get in?
Mostly through exposed or stolen cloud identity tokens. API keys found in public GitHub repositories and exposed endpoints are also used. A fake login page even bypassed MFA.
What are LLM Mixers?
They are illicit services that resell stolen access to models. They act as gateways between those who breached the systems and those who buy the tokens. Google describes them as a growing division of labor.
How can you defend yourself?
With greater visibility over LLM platforms and minimal privileges for accounts and users. Every unauthorized activation should be treated as a critical event. Google lists these points in the report.
What to watch in the coming months on the abuse of AI models
Google expects LLMjacking to overtake cryptojacking as a form of resource theft. It is worth watching where the risk moves next.
- Check whether your repositories, including old ones, contain API keys or tokens, and rotate them.
- Set spending thresholds and billing alerts on AI services, so a spike is spotted immediately.
- Review the AI tools installed by your team and keep routing gateways such as LiteLLM up to date.
