Google Warns LLMjacking Attacks Are Costing Some Enterprises Up to $1 Million in Cloud Charges

Summary

Google's Threat Intelligence Group and Mandiant warned that attackers are conducting LLMjacking, a resource hijacking tactic in which they obtain an organization's LLM API key or cloud identity token through phishing, source code leaks, misconfigured environments, or exposed client-side code. Some organizations reported fraudulent charges above $100,000 in a single day, with cumulative losses reaching $1 million before access was revoked. The charges are paid by the legitimate account owner.

Related items

• InfoCrowdStrike to acquire Fiddler, Dreadnode to extend AI security across agent lifecycleSame vendor · CSO Online
• MediumGoogle: LLMjacking attacks rack up $1 million in cloud AI chargesSame vendor · BleepingComputer
• InfoOpenAI says ChatGPT is catching up to Google in searchSame vendor · The Verge (AI)
• InfoGoogle is entirely disabling Search in schools that don’t want AISame vendor · The Verge (AI)
• InfoMicrosoft named a Leader in the 2026 Gartner® Magic Quadrant™ for AI Agent Management Platforms  Same vendor · Microsoft Security Blog