Usage chart showing LLMJacking generating a spike in API requests (Source: Google) In 2026, Mandiant responded to several of these LLMJacking incidents, recorded in attacks on the financial services, retail, technology … More → Large language model hijacking attacks, also known as LLMjacking, are generating large fraudulent cloud charges, with some organizations losing more than $100,000 per day. Companies can record costs as high as $1 million due to fraudulent calls using stolen API keys, researchers at Google's Threat Intelligence Group (GTIG) and Mandiant in analyzed incidents. Based on their observations, there are "two distinct operational clusters coordinating to compromise and monetize enterprise LLM infrastructure." The researchers identified two categories of threat actors: those who scan for publicly exposed LLM endpoints and those who steal valid API keys from unprotected machines.
ai-devtools —
Stolen AI access leaves companies with cloud bills of up to $1 million
Criminals who break into corporate cloud accounts are using the stolen access to run AI models at the victim’s expense, in some cases racking up more than $100,000 in charges in a single day, Google Threat Intelligence Group (GTIG) and Mandiant researchers have found.
Reported by helpnetsecurity.com and bleepingcomputer.com.
