Google: LLMjacking cloud bills have hit $1 million

Google’s threat intelligence group and Mandiant say stolen access to enterprise language models is already a line on the cloud bill. In the incidents they describe, fraudulent model use passed $100,000 in a single day. At some organizations the charges reached $1 million before the key was revoked.

The victims in the report are in North America, South America, and Asia Pacific, across financial services, retail, technology, and transportation. The thing being stolen is model quota and the compute behind it. The company that owns the key pays the invoice.

How the key gets out

Google calls the tactic LLMjacking: someone else spends your model account. The ways in are ones defenders already track. A phish. A key left in source. A misconfigured cloud identity. A token shipped in client-side code. The credentials that showed up most often were cloud identity tokens, including IAM credentials, service-account keys, GitHub personal access tokens, and live session tokens.

A crew Google tracks as UNC6993 entered a cloud instance through a misconfigured service-account key and reached a model API from there. The same crew hosted a page dressed up as a portal for joining a group of model users. People were sent onward to the real model site, and the page collected a live access token, which skipped the password and the multi-factor check. In another case, a stolen personal access token was used to read private repositories, and the intruder then moved through a suspected flaw in a package running inside a container.

Past that foothold, the operators hunted more secrets. They enumerated cloud services, repositories, and data stores, cloned code to find hardcoded keys, read access logs for a second environment, and queried databases. They created cloud identities, added SSH keys to virtual machines, and stood up service accounts presented as internal billing tools. Identities that were allowed to mint tokens issued short-lived credentials for higher-privilege accounts and pulled material out of cloud secret managers, including infrastructure credentials, database passwords, and third-party API keys. A pattern in the report keeps creating and deleting short-lived service accounts so a rate limit never settles on one name.

The note also names a privilege flaw in the LiteLLM routing software, CVE-2026-40217. This briefing will not describe that bug. If you run LiteLLM, take the current fix. The router can see every model key you asked it to carry.

A resale market, and a $60 plan

Google says the work has split. One side steals the access. Another side, which the report calls LLM mixers, proxies and pools that capacity and sells it. One storefront, Jet Night, has advertised unlimited use of a frontier model for about $60 a month. The quota behind that price is an enterprise account. The charge lands on the enterprise.

A report last week from Symantec and Carbon Black describes a grey-market relay active since early 2026. It installs the genuine OpenAI Codex and Anthropic Claude Code command-line tools, then sends their requests through its own servers. The research says the setup turns the tool’s sandbox off and stops vendor telemetry. Prompt harvesting and rewritten answers are unshown in that research. The traffic still leaves the vendor path on the contract, and the credential loaded into the tool is the relay’s.

The relay has mostly appeared at about a dozen organizations in mainland China, plus multinational subsidiaries in South Korea, Taiwan, and Malaysia. The sectors named are industrial automation, electronics manufacturing, semiconductors, pharmaceuticals, shipping, tire manufacturing, petrochemicals, and data-center services. In the researchers’ account, the install starts with an employee who wants a Western coding assistant and buys it from a reseller in a market where the vendor does not sell directly.

What to do before the invoice

Put a budget alarm on model spend that fires the same day, at a figure finance would notice, well under $100,000. A monthly bill arrives after the $1 million case has already happened.

Inventory model keys, cloud service-account keys, and GitHub personal access tokens. Rotate anything that has lived in a repository, a client-side bundle, a ticket, or a phished laptop. Revoke the old value at the provider. Alert when a new key appears, and when a service account is created and deleted in a short span.

A service account that can create other credentials is how these crews step around multi-factor checks. Remove token-minting rights from any identity whose job is to call a model. Treat a live session token like a password. A portal that asks staff to hand one over is an incident, and the training should say so before the page shows up.

Company coding tools should talk to the vendor endpoint on the contract. A command-line client pointed at a third-party relay is an incident even though the binary is the vendor’s. If a machine has already been repointed, restore the vendor path, turn the sandbox back on, and turn telemetry back on. Tell people that a reseller for Codex or Claude Code is the wrong door on a corporate machine.

Patch CVE-2026-40217 anywhere LiteLLM sits in front of production models, and keep model keys out of the browser. The $1 million figure is what Google says accumulated before revocation. The useful clock is shorter than that.

This briefing relies on public reporting by The Hacker News, on the Google Threat Intelligence Group and Mandiant note that reporting describes, and on research from Symantec and Carbon Black. It does not include exploit procedures.