LLMjacking: stolen AI keys are costing companies up to $1 million, and how to protect yours

Criminals have found a new way to profit from AI: steal someone else’s access and let them pay the bill. Google’s Threat Intelligence Group and Mandiant call it LLMjacking, and say it is costing some organizations up to $1 million. Here is how it works and how to protect yourself.

What is LLMjacking?

LLMjacking means hijacking access to a paid large language model, usually by stealing an API key or cloud login, and using it to run AI workloads at the victim’s expense. The victim only finds out when the cloud bill arrives or an alert fires.

How bad is it?

According to Google’s report, as covered by Help Net Security and BleepingComputer:

• In some cases, fraudulent charges exceeded $100,000 in a single day.
• Cumulative charges at some organizations reached $1 million before access was cut off.
• A reseller service called Jet Night, which sold an unlimited AI plan for about $60 a month and which Google believes ran on stolen keys, was used to make more than 500,000 AI calls in under eight hours. That left one victim with nearly $1 million in token costs.
• A group Google tracks as UNC6993 used stolen AI keys to try to create more keys and switch on related services inside victims’ cloud projects, running up more than $100,000 in charges quickly.

How do criminals get the keys?

• Keys left in public code. Attackers scan public GitHub repositories for AI API keys and test them with tiny requests that stay under alert thresholds.
• Stolen cloud credentials, such as cloud login keys, service account keys, GitHub tokens and active session tokens.
• Exposed AI servers, such as publicly reachable Ollama endpoints.
• Keys with surprising powers. A Cloud Security Alliance note says some Google Cloud API keys long treated as harmless, such as those used for maps and embedded in website code, gained the ability to call Gemini once that service was enabled. Check what your keys can do.

Attackers don’t need you to use AI. Google says they can use stolen cloud access to switch on AI services and run up bills in minutes or hours.

How to protect your AI keys and cloud accounts

1. Set spending limits and budget alerts on your AI and cloud accounts. A cap can turn a $1 million bill into a much smaller one.
2. Use quotas on AI services so one key can’t make unlimited calls.
3. Never put keys in code you publish. Use environment variables or a secrets manager, and turn on secret scanning for your repositories.
4. Restrict each key to the services, apps and addresses that need it.
5. Deny access to AI services by default and turn them on only where needed.
6. Rotate keys regularly and immediately if you think one leaked. See our report on Railway’s exposed environment variables for why this matters.
7. Turn on two-factor login for cloud, GitHub and AI accounts.
8. Don’t leave AI servers exposed to the open internet.

What about everyday users?

You may not run a cloud account, but you can still be tempted by the criminals’ products. A premium AI plan priced far below what the provider charges, such as “unlimited” access for a few dollars, is a red flag. It may run on stolen keys, and you could lose your data or payment details. Stick to official plans from the providers. See our guide to choosing an AI assistant.

What to do if you think a key was stolen

1. Revoke or rotate the key immediately.
2. Check your cloud billing and usage logs for unusual calls and new keys or services.
3. Remove anything you did not create, and review who has access.
4. Contact your cloud provider about charges.

Our 10-minute checklist covers the basics.

Frequently asked questions

What is LLMjacking?

It is the theft of paid AI access, usually through stolen API keys or cloud credentials, so criminals can run AI models while the victim pays.

How much can LLMjacking cost?

Google says charges can exceed $100,000 in one day and reach $1 million in total at some organizations.

How do attackers find AI API keys?

Often in public code repositories, through stolen cloud credentials or from exposed AI servers.

How can I stop it?

Set spending limits and alerts, keep keys out of public code, restrict and rotate keys, and use two-factor login.

Sources

• Stolen AI access leaves companies with cloud bills of up to $1 million (Help Net Security)
• Google: LLMjacking attacks rack up $1 million in cloud AI charges (BleepingComputer)
• Google warns LLMjacking attacks are costing some enterprises up to $1 million (The Hacker News)
• Hackers are using LLMjacking attacks to hijack company AI usage (TechRadar)
• Cloud billing hijacking as LLMjacking: security implications and guidance (Cloud Security Alliance)