Google LLMjacking report: $100K a day on stolen AI keys

LLMjacking is now a line item. Google Threat Intelligence Group and Mandiant published The Rise of LLMJacking on November 2, and the numbers are blunt: fraudulent model usage topping $100,000 in a single day, and cumulative charges at some organizations reaching $1 million before access was cut off. Nobody stole data. They stole your right to call a model, and billed you for it.

What actually happened

The attack is simple. Get a cloud credential, turn on a model API, run tokens through it, resell the access. Google says most intrusions used stolen or exposed cloud identity: service account keys, GitHub personal access tokens and live session tokens. Others went after model endpoints left open to the internet, including exposed Ollama servers. One actor scraped keys from public GitHub repos and validated them with requests that set max_tokens=1, small enough to slip under volume alerts.

The named actor, UNC6993, got into a cloud instance in mid-2026 through a misconfigured service account key, reached the LLM API, then created extra API keys and enabled more services to scale usage. Charges passed $100,000. The same group ran a fake "application portal" that had users paste an active access token, which walks straight past passwords and MFA.

The resale side is what Google calls LLM Mixers: gateways that pool stolen credentials, meter usage and sell subscriptions. One, Jet Night, advertised unlimited frontier-model access for about $60 a month against a legitimate price of $100 to $250. One operator made more than 500,000 API calls in under eight hours on stolen third-party keys and passed nearly a million dollars in token costs to the victim. In several cases the victim had model services disabled entirely, and the attacker used stolen keys to switch on Bedrock or the Gemini API. A follow-on cluster exploited LiteLLM CVE-2026-40217, the gateway we keep writing about.

Victims span financial services, retail, technology and transportation, SiliconANGLE reports.

Why it matters for your business

You have an OpenAI or Anthropic key in a .env, a Google Cloud project you opened once, and maybe Ollama on a spare box. That is the attack surface Google describes, and the damage is a bill, not a breach notice. We saw the infostealer version already. The part of Google's list that fits a five-person company:

• One key per app, per environment, with a hard cap. A key limited to $200 a month cannot produce a $100,000 day. Split dev and prod.
• Treat "model service enabled" as an alarm. If you do not use Bedrock or Vertex, block them with an org policy.
• Rotate and scan. Secrets in a vault, secret scanning on every repo, nothing in client-side code.
• Never expose Ollama. Bind it to localhost or put auth in front. An open port is a free GPU for someone else.
• Patch LiteLLM if you run it.

Sources: Google Cloud Threat Intelligence, "The Rise of LLMJacking", SiliconANGLE, The Hacker News.