Google says LLMjacking attacks generated up to $1 million in cloud charges

In a November 2 blog post, Google's Mandiant says attackers hijacked enterprise access to large language models and generated more than $100,000 in fraudulent cloud charges in a single day. Cumulative charges at some affected organizations reached $1 million before access was revoked.

The incidents affected financial services, retail, technology, and transportation organizations across North America, South America, and Asia Pacific. Attackers commonly entered through exposed or stolen cloud identity tokens, service account keys, GitHub access tokens, active sessions, public model endpoints, and LLM API keys.

Some attackers created additional API keys, enabled model services, launched large inference streams, and provisioned GPU instances. Others routed stolen access through LLM Mixers, which pool credentials and resell model access. One operation made more than 500,000 API calls in under eight hours and passed nearly $1 million in token costs to a victim.

Mandiant recommends restricting account permissions, rotating secrets, scanning code for exposed keys, setting API quotas and spending caps, and monitoring for unexpected model service activation. Organizations should also watch for small credential validation requests and patch model routing software, including LiteLLM flaws such as CVE-2026-40217.