Stolen AI Keys Run Up $1m Cloud Bills at Some Firms

Hijacking a company's access to a large language model, known as LLMjacking, is now producing large fraudulent cloud bills. Researchers at Google's Threat Intelligence Group (GTIG) and Mandiant say some organisations lost more than $100,000 a day, and cumulative charges at some reached $1,000,000.

Why the victim pays

An API key is the secret that lets software call an AI service and have the usage billed to an account. Whoever holds a valid key can run requests that land on the owner's invoice.

That is what the researchers observed. After resale, traffic can jump abruptly, at times past 1,000 requests a second. The provider counts it as ordinary use and bills the victim for the tokens.

GTIG and Mandiant saw more of this activity this year than before.

Resellers and the "mixers"

Initial access is sold on to services known as LLM mixers. They offer AI access at very low prices and relay customers' prompts to the hijacked services through stolen keys.

Jet Night is one example. It sells plans advertised as unlimited for $60 a month. Google says another actor made more than 500,000 LLM API calls in under eight hours, using stolen third-party keys to power jet-night.com. The victim organisation was handed nearly one million dollars in token costs. The researchers also named newapi[.]pro as a relay service.

A separate cluster, UNC6993, appears to use gateway tools that pool stolen keys and spread requests across them. Google thinks it likely sells access on underground forums.

How the attackers get in and stay

The researchers separate two kinds of actors. Some scan for publicly exposed LLM endpoints. Others steal valid API keys from machines that lack protection.

Entry points include exposed or compromised cloud credentials, service account keys, GitHub tokens, active session tokens and LLM API keys. Once inside, attackers look for credentials, logs, databases and secret managers. They also set up hidden accounts or add their own SSH keys to stay in.

The researchers have also seen CVE-2026-40217 exploited. It is a flaw in LiteLLM that allows code to run on the server through the custom-code guardrail testing endpoint.

In some cases the victim's own cloud hosted the attackers' proxy endpoints and agentic workloads. One actor deployed public reverse proxies with custom Node.js bundles, exposing endpoints for several frontier models under the persona D1337-KAIROS.

The defences Google lists

Google puts identity and access management first, along with securing the supply chain. It wants centralised secrets platforms for rotating keys, and users without extended privileges unless their role needs them. Its advice on permissions: "Deny all permissions that are not explicitly required, including access to Cloud LLM services."

The list continues with phishing-resistant multi-factor authentication, monitoring that exposes unauthorised "shadow AI" services, and API usage and spending limits. Cloud audit and inference logs should be switched on and watched for signs of misuse, including attempts to disable logging.

Our View

Spending limits look like one of the simplest items on Google's list. A cap would turn a surprise invoice into an alert. The report does not say how many organisations were hit or how many recovered the charges, and billing disputes with cloud providers would show who bears the cost in the end.

Source: BleepingComputer