{"data":{"id":"8e6cf1d3-68c4-495f-aea7-16597ff05945","title":"Enterprises pay $100,000 a day for AI they never ordered","summary":"Google Threat Intelligence Group (GTIG) warns of LLMjacking campaigns in which cybercriminals hijack enterprise cloud and model access and resell it through underground subscription services called LLM Mixers. GTIG reports that fake cloud charges can exceed $100,000 in a single day, and that cumulative charges reached $1 million in some incidents before access was revoked. The source text is cut off mid-sentence while describing a follow-on actor that exploited a user ID rebinding vulnerability in the LiteLLM gateway.","solution":"N/A -- no mitigation discussed in source.","labels":["security","industry"],"sourceUrl":"https://www.csoonline.com/article/4243863/enterprises-pay-100000-a-day-for-ai-they-never-ordered.html","publishedAt":"2026-11-03T11:52:38.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"medium","attackType":["supply_chain","other"],"issueType":"news","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["Google"],"affectedVendorsRaw":["Google Threat Intelligence Group","LiteLLM","Jet Night","new-api","gcli2api"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-11-03T11:52:38.000Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","availability"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":["AML.T0010"]}}