Businesses are facing a growing threat from “LLMjacking” attacks, in which malicious actors hijack enterprise Large Language Model (LLM) accounts and drive up cloud bills. Google’s latest warning reveals that attackers are using stolen or exposed API keys and misconfigured environments to access cloud computing and AI services fraudulently—leaving organizations with the tab. In some cases, cloud charges have spiked over $100,000 in a single day, with cumulative losses reaching as high as $1 million before the misuse is detected and access revoked.
How It’s Happening: Key Exposure and Misconfigurations
The primary methods attackers use to infiltrate LLM systems include leaked cloud identity tokens, service account keys, GitHub personal access tokens, and exposed client-side credentials. Threat groups such as UNC6993 specifically exploit misconfigured service account keys to gain entry and circumvent safeguards like multi-factor authentication (MFA). In one attack, users were tricked into pasting authentication tokens into pages masquerading as legit AI tool portals, allowing attackers to tap into their sessions directly.
Other reported cases involve attackers extracting internal secrets from code hosted in private repos, abusing cloud identity permissions to spin up privileged accounts, and generating temporary credentials. Some of these credentials provide broad access across multiple cloud regions—escalating both capability and potential damage.
Monetizing Hijacked Access: LLM Mixers and Proxy Chains
Rather than directly using stolen resources, some groups are becoming intermediaries. Known as “LLM Mixers,” these actors aggregate, proxy, and resell unauthorized LLM access via underground storefronts. Platforms such as “Jet Night” purport to offer unlimited access to frontier models for a monthly fee. Similarly, a shady relay service has been found that installs legitimate AI command-line tools (like those from OpenAI and Anthropic) on client machines, then reconfigures them to route all traffic through proxy servers and replace real credentials with tokens issued by the mixer.
These services often disable built-in telemetry, error reporting, sandbox isolation, and even operate only in certain geographic regions to avoid detection—particularly in areas remote vendors don’t officially serve. This approach lets attackers take over enterprise quotas while delaying detection and maximizing illicit gains.
Google’s analysis shows that criminals are shifting from traditional resource theft to this new, high-margin model. By scaling up using techniques like token proxying, model streaming, automatic account rotation, and GPU provisioning, ransomware-style payouts from cryptojacking may give way to LLMjacking as the preferred technique.
As organizations deploy advanced agentic workflows and stronger foundation models in production, criminals are refining their reconnaissance to target exposed tokens and vulnerable middleware in model routing. Vulnerabilities like CVE-2026-40217 in LiteLLM have already been exploited to escalate privileges.
What to Watch For:
- Regularly scan for exposed credentials—tokens in repos, misconfigured service accounts, unused keys, etc.
- Apply strict role-based access controls; limit permissions for accounts and services to the bare minimum necessary.
- Ensure strong identity governance and enforce MFA everywhere possible, even for privileged cloud credentials.
- Monitor cloud billing and resource usage closely; set alerts for unusual spikes in AI/compute consumption.
- Audit installations of AI tools and CLIs to verify they communicate with official endpoints and aren’t reconfigured by proxy or routing scripts.
LLMjacking represents a dangerous evolution of cloud-based threats—where attackers turn AI infrastructure itself into a profit center. Enterprises can no longer treat these models as peripheral: they’re now prime targets, capable of generating massive costs with little warning. Going forward, the most resilient organizations will be those that build rigorous credential hygiene, micro-targeted access controls, and cost anomaly detection into their AI strategy. Watch for new detection tools and vendor responsibilities in the path ahead.
