Google: LLMjacking attacks rack up $1 million in cloud AI charges
- Published
- Record updated
Summary
Google's Threat Intelligence Group and Mandiant report that LLMjacking attacks, in which attackers abuse stolen LLM API keys, are generating fraudulent cloud charges, with some organizations losing over $100,000 in a single day and cumulative charges reaching $1,000,000. Attackers resell access through LLM mixers such as Jet Night, which passed nearly one million dollars in token costs to one victim organization. The researchers also observed attackers exploiting CVE-2026-40217 in LiteLLM to run arbitrary code on the server.
Mitigation
Google recommends prioritizing Identity and Access Management (IAM) and securing the supply chain, using centralized secrets platforms to rotate and manage sensitive keys and secrets, limiting user privileges to what the role requires and denying all permissions not explicitly required, including access to Cloud LLM services, enforcing phishing-resistant multi-factor authentication (MFA), and ensuring monitoring tools give comprehensive visibility to identify unauthorized LLM and AI services (shadow AI). The source text is cut off before it finishes describing the recommendation to set API usage and spending limits.
Related items
- InfoCrowdStrike to acquire Fiddler, Dreadnode to extend AI security across agent lifecycleSame vendor · CSO Online
- InfoOpenAI says ChatGPT is catching up to Google in searchSame vendor · The Verge (AI)
- InfoGoogle is entirely disabling Search in schools that don’t want AISame vendor · The Verge (AI)
- InfoMicrosoft named a Leader in the 2026 Gartner® Magic Quadrant™ for AI Agent Management Platforms Same vendor · Microsoft Security Blog
- MediumGoogle Warns LLMjacking Attacks Are Costing Some Enterprises Up to $1 Million in Cloud ChargesSame vendor · The Hacker News