Google Warns LLMjacking Is Costing Companies $100,000 a Day: What IT Teams Should Do Now

LLMjacking works like cryptojacking, except the stolen resource is access to paid AI models. Attackers obtain a working API key, cloud service account key or session token, then run inference at the victim's expense or resell the access. According to The Register, Google expects attackers to favor it over cryptojacking.

BleepingComputer reported on November 3, 2026 that Google Threat Intelligence Group (GTIG) and Mandiant describe two coordinated clusters: actors who scan for exposed LLM endpoints and actors who steal valid keys from unprotected machines. This post is based on those two reports and Google's recommended controls.

What happened

Google's report, covered on November 2 and 3, 2026, says organizations have lost more than $100,000 in a single day and up to $1,000,000 in cumulative charges before access was revoked. The provider logs the traffic as legitimate use, so the victim receives the bill.

• Key theft and expansion: a cluster tracked as UNC6993 obtained LLM API keys, generated more keys and enabled services in victim cloud projects, causing $100,000 in charges in one case.
• Resale: per both reports, an actor made more than 500,000 LLM API calls in under eight hours with stolen third-party keys to power a token-routing service called Jet Night, which advertised unlimited access for about $60 a month.
• Burn and rotate: another actor repeatedly created and deleted short-lived service accounts to evade rate limits, according to The Register.
• Initial access: a misconfigured service account key in a cloud instance, plus a fake portal that tricked users into pasting JSON containing live access tokens, which bypassed passwords and MFA.

Why it matters for B2B SaaS buyers

AI features are now billed per token, so a leaked key is a direct financial exposure. Unlike a stolen database credential, it can create a six-figure invoice within hours while every request looks valid in your logs.

The risk sits with any team that embeds model APIs in products, internal tools or workflows, including SaaS vendors you buy from. Ask suppliers how they store model keys and cap spending. A related incident, the LiteLLM supply chain compromise, showed how gateway software can expose those keys, and BleepingComputer notes attackers also exploited a LiteLLM vulnerability, CVE-2026-40217. Our note on the OpenCode console breach covers another key exposure.

The OWASP guidance on unbounded consumption lists uncontrolled usage and denial-of-wallet as LLM application risks, which is exactly the financial damage seen here.

What to do now

Start with the controls Google recommends: tight identity management, centrally managed secrets and spending limits. Most of these cost little and can be done this week by cloud and platform teams.

1. Inventory model access: list every API key, service account and gateway that can call an LLM, including shadow AI tools teams adopted without approval.
2. Move keys into a secrets manager such as Google Cloud Secret Manager and rotate them on a schedule. Follow key management practice in NIST SP 800-57.
3. Apply least privilege: deny access to cloud AI services unless a role explicitly needs it.
4. Set hard budgets and alerts: configure quotas, per-key limits and billing alerts that fire on spikes, not only monthly totals.
5. Scan for leaked keys: run automated secrets scanning on repositories and CI logs, and revoke anything found.
6. Enforce phishing-resistant MFA and train staff not to paste token JSON into unknown portals.
7. Log and watch: enable cloud audit and inference logs and alert on new service activations, failed credential checks and attempts to disable logging.

Related SaaSPodium categories

Spend visibility, privileged access control and identity tooling each reduce LLMjacking risk in a different way, and SaaSPodium lists products for all three. Teams reviewing exposure can compare tools in our Privileged Access Management, SaaS Spend Management and Identity and Access Management categories. Spend tools help catch unexpected AI charges, while PAM and IAM tools reduce the number of standing credentials worth stealing.

Frequently Asked Questions

What is LLMjacking?
LLMjacking is the theft of cloud or AI credentials, such as API keys, service account keys or session tokens, to run large language model requests on a victim's account. The victim pays the usage bill, and attackers may also resell the access.

How much can an LLMjacking attack cost?
Google's reporting, covered on November 2 and 3, 2026, describes charges above $100,000 in a single day and cumulative losses up to $1 million at some organizations. Costs depend on the model used and how quickly access is detected and revoked.

What is the fastest way to limit LLMjacking risk?
Set hard spending limits and billing alerts on every AI account, store keys in a secrets manager and rotate them, apply least privilege so only required roles can call models, and enable audit logs so unusual usage is detected within minutes.