Google warns LLMjacking attacks cost enterprises up to $1 million in cloud charges

· Cybersecurity

Google warned that threat actors are hijacking enterprise access to large language models to fraudulently consume expensive computing resources and AI services, a tactic known as LLMjacking. Attackers typically obtain API keys through phishing and other means, then resell access to the stolen LLM capacity; some organizations racked up as much as $1 million in cloud charges, with some losing more than $100,000 per day before access was revoked. Researchers describe the practice as a thriving cybercriminal business model adapted for the LLM era, turning resource hijacking into a lucrative enterprise. The warning signals that as companies expand generative AI deployments, API credential theft is becoming a direct financial risk rather than only a data-exposure issue.

Why it matters：As enterprises scale generative AI usage, stolen API credentials become a direct cost and fraud vector, pushing security teams to govern AI access keys as tightly as any other privileged credential.

Key points

  • Attackers obtain API keys through phishing, then resell access to stolen LLM capacity.
  • Some victims saw cloud bills of up to $1 million before access was revoked.
  • Google framed LLMjacking as a resource-hijacking model adapted to the AI era.

Sources (original reporting)

More stories from this day