Enterprises pay $100,000 a day for AI they never ordered

Summary

Google Threat Intelligence Group (GTIG) warns of LLMjacking campaigns in which cybercriminals hijack enterprise cloud and model access and resell it through underground subscription services called LLM Mixers. GTIG reports that fake cloud charges can exceed $100,000 in a single day, and that cumulative charges reached $1 million in some incidents before access was revoked. The source text is cut off mid-sentence while describing a follow-on actor that exploited a user ID rebinding vulnerability in the LiteLLM gateway.

Related items

• InfoCrowdStrike to acquire Fiddler, Dreadnode to extend AI security across agent lifecycleSame vendor · CSO Online
• MediumGoogle: LLMjacking attacks rack up $1 million in cloud AI chargesSame vendor · BleepingComputer
• InfoOpenAI says ChatGPT is catching up to Google in searchSame vendor · The Verge (AI)
• InfoGoogle is entirely disabling Search in schools that don’t want AISame vendor · The Verge (AI)
• InfoMicrosoft named a Leader in the 2026 Gartner® Magic Quadrant™ for AI Agent Management Platforms  Same vendor · Microsoft Security Blog