Google Warns LLMjacking Attacks Are Draining Cloud Budgets by Up to $1 Million
Google has issued a warning about a growing class of attacks in which adversaries steal enterprise credentials for Large Language Model (LLM) services and resell or abuse the underlying compute, with some organizations reportedly facing cloud charges approaching $1 million as a result. The tactic, widely referred to as LLMjacking, is essentially resource hijacking retooled for the generative AI era.
What Is LLMjacking?
LLMjacking describes the theft and abuse of API keys and access credentials that grant access to commercial LLM providers and hosted AI services. Because these services are metered by token usage or compute time, an attacker who obtains valid credentials can run large volumes of inference workloads at the victim's expense. The stolen capacity is frequently resold through underground channels or used to power illicit services without the legitimate account holder ever touching a model directly.
Google's advisory frames the technique as an evolution of older resource-hijacking schemes—such as cryptojacking—where attackers appropriated compute for their own gain. The difference is that LLM access is expensive, centrally billed, and often poorly monitored, making it an attractive target.
How Attackers Get In
According to the report, attackers obtain LLM credentials through several familiar but frequently overlooked vectors:
- Phishing campaigns that harvest API keys or cloud console credentials.
- Source code leaks, where keys are hardcoded into repositories and later exposed publicly.
- Misconfigured environments, including cloud storage buckets or services left accessible without authentication.
- Exposed client-side code, where API keys embedded in mobile apps or browser-side JavaScript can be extracted by anyone inspecting the application.
The common thread is credential exposure. Once a key is in hand, the attacker needs no exploit against the model provider itself—they simply authenticate as the victim and begin consuming paid resources.
Why LLMjacking Is Easy to Miss
Several factors make this type of abuse difficult to detect through conventional security monitoring. LLM traffic often originates from legitimate cloud infrastructure and uses sanctioned provider endpoints, so network-based controls may see nothing unusual. Billing anomalies can take days or weeks to surface, and by then the attacker may have consumed substantial capacity.
Organizations that grant broad, long-lived API keys to developers, applications, or third-party integrations widen the exposure. When those keys are not scoped to specific models, rate-limited, or tied to individual services, a single leak can translate into unrestricted access to premium models.
The Financial Impact
The headline figure—costs reaching up to $1 million in cloud charges for some enterprises—underscores that LLMjacking is not only a security problem but a financial and operational one. Unexpected bills of that magnitude can disrupt budgets, trigger disputes with providers, and, in severe cases, force organizations to suspend AI-dependent services while credentials are rotated and usage is investigated.
Because billing is tied to consumption rather than a fixed subscription, the damage scales with how quickly abuse is detected. A key that remains valid for weeks can generate far more cost than one revoked within hours.
Mitigation Guidance
Google's warning points toward a set of practical controls that reduce both the likelihood and impact of LLMjacking:
- Inventory and scope API keys. Identify every credential with access to LLM services, restrict permissions to only the models and endpoints required, and retire unused keys.
- Eliminate hardcoded secrets. Scan source code and repositories for embedded keys, and move secrets into managed secret stores. Never ship API keys in client-side code.
- Rotate credentials regularly and immediately upon any suspicion of exposure. Short-lived tokens are preferable to long-lived static keys.
- Set usage quotas and budget alerts. Configure per-key rate limits and spending thresholds so anomalous consumption triggers an alert before costs escalate.
- Monitor LLM usage patterns. Watch for unusual volumes, off-hours activity, unfamiliar source locations, or requests for models the application does not normally use.
- Harden cloud configurations. Audit storage buckets and services for public exposure and enforce authentication by default.
The Broader Trend
LLMjacking reflects a wider shift in attacker economics. As enterprises pour budget into AI services, the credentials that unlock those services become valuable assets in their own right—worth stealing, trading, and monetizing even without access to sensitive data. Security teams that treat LLM keys as low-risk developer conveniences are likely to find themselves on the wrong side of a billing statement.
Google's advisory is a reminder that AI adoption demands the same credential hygiene, monitoring, and cost governance applied to any other cloud resource. Organizations should treat LLM access as privileged infrastructure and build detection around usage and spend, not just around traditional network indicators.
