Google Warns LLMjacking Attacks Inflate Enterprise Cloud Bills to $1 Million

What Happened

Google announced on Monday that a new form of resource hijacking, dubbed LLMjacking, is inflating cloud bills for enterprises that use large language models. Attackers are exploiting compromised API keys to send requests to LLM services, causing the legitimate account owner to pay for the compute time. The technique is similar to cryptojacking but produces billable activity in seconds rather than minutes.

In the incidents reported, attackers leveraged phishing, code leaks, misconfigured IAM credentials, and exposed client‑side code to obtain valid keys. Once in possession of a key, they can invoke the model as often as they wish, generating hundreds of thousands of dollars in usage before the key is revoked.

Who Is Affected

The attacks have been observed across North America, South America, and the Asia‑Pacific region. Sectors hit include financial services, retail, technology, and transportation. Any organization that relies on paid LLM APIs—whether through Google Cloud, AWS Bedrock, or Azure OpenAI—faces risk if its credentials are not properly secured.

Both large enterprises and mid‑market companies have reported incidents, indicating that the threat is not limited to high‑profile targets. The common denominator is the presence of exposed or weakly protected API keys.

Impact

Google’s threat intelligence group measured fraudulent usage spikes of more than $100,000 in a single day in several cases. In the most extreme example, cumulative charges exceeded $1 million before the offending key was disabled. These amounts represent a direct financial loss that is difficult to recover.

Beyond the bill, the attacks can also consume quota limits, delay legitimate requests, and create a false sense of normal activity that may mask other malicious behavior.

Exposure

Initial access is typically achieved through exposed cloud identity tokens such as IAM service account keys, GitHub personal access tokens, or active session cookies. Attackers then use these tokens to call the LLM endpoint or to retrieve the API key from a misconfigured secrets store.

In one documented case, a misconfigured service account key allowed an adversary to retrieve the key for a Google Cloud LLM API. The attacker subsequently spun up a bot that sent thousands of prompts, each of which consumed compute credits.

What to Do

Defenders should immediately audit all LLM API keys and enforce the principle of least privilege. Keys that are not in active use should be rotated or deleted. The following actions are recommended:

• Enable IAM key rotation and enforce short lifetimes for service account keys.
• Use secret management services (e.g., Google Secret Manager, AWS Secrets Manager) and restrict access to the secrets store.
• Implement API gateway throttling and request quotas for LLM endpoints.
• Enable logging for all LLM API calls and set up alerts for anomalous usage patterns.
• Apply network segmentation so that only trusted services can reach the LLM endpoint.
• Educate developers on secure handling of client‑side code and on the risks of embedding keys in front‑end assets.
• Conduct regular penetration tests that include credential discovery and LLM usage simulation.

What to Watch

Attackers are evolving their techniques. Future vectors may involve automated credential harvesting from CI/CD pipelines or exploitation of zero‑day misconfigurations in new AI services. Keep an eye on emerging threat groups such as UNC6993, which have demonstrated the ability to pivot from a compromised service account to LLM exploitation.

Also monitor for signs of “chatbot hijacking,” where attackers manipulate customer‑facing chatbots to generate unauthorized requests. Such activity can be subtle and may not trigger traditional alerts.