Google's threat intelligence team and Mandiant say attackers who steal cloud credentials or AI API keys are billing victims for model use: more than $100,000 in a single day in some incidents, and up to $1 million in total before access was cut. Spending caps, per-model key limits and alerts on new AI service enablement are the fixes.
If your company has a cloud account or an AI API key, set a spending cap on it this week. Google Threat Intelligence Group and Mandiant published research on November 2 showing attackers who steal cloud credentials can run up more than $100,000 in AI charges in a single day. At some victims, the total reached $1 million before anyone revoked access.
What Google found
Google calls it “LLMjacking.” An attacker gets into your cloud account or takes an API key, then uses your access to call AI models. You get the bill. Google’s report says the incidents hit companies in North America, South America and Asia Pacific, in financial services, retail, technology and transportation. Unlike cryptomining, which drains an account slowly, these attacks can spike charges within hours. One actor made more than 500,000 model API calls in under eight hours.
How attackers got in, according to Google:
- Stolen cloud identity tokens. This was the most common route: leaked IAM credentials, service account keys, GitHub personal access tokens and live session tokens.
- A fake app portal. A group Google tracks as UNC6993 tricked users into pasting a JSON payload that held an active access token. That skipped both the password and MFA. The group then turned on AI services, created more API keys and ran up over $100,000 in charges.
- API keys left in public GitHub repos. Attackers tested each key with a tiny one-token request first, small enough to slip under volume alerts.
- Exposed model servers and proxies. Google cites open Ollama instances and a flaw in LiteLLM, the popular model-routing proxy, tracked as CVE-2026-40217. It lets a standard key be upgraded to an admin key.
Much of the stolen access gets resold. Google describes “LLM mixers,” gray-market gateways that pool stolen keys and sell model access. One, Jet Night, sold an “unlimited token” plan for about $60 a month. Google says that service alone passed nearly $1 million in token costs to one victim.
The Hacker News, which received the research ahead of publication, also notes a separate Symantec and Carbon Black report from last week. It describes a relay that installs the real Codex and Claude Code command-line tools, then rewrites their settings to send requests through third-party servers.
Your AI bill is now an attack surface
Put a hard cap on every account that can call a model. Google’s first billing recommendation is budget alerts and spending caps. On Google Cloud, spend caps went generally available on October 30 and pause Gemini API and Vertex AI use once a project hits its budget. They can overshoot, so set the cap below what you can afford to lose.
Scope each key to one job. Google recommends restricting keys by model, environment and usage limit, so a key built for a cheap utility model can’t call an expensive frontier model. If your team shares one all-access key across dev and production, split it.
Alert when someone turns on an AI service. In several incidents the victim had AI services switched off, and the attacker switched them on with stolen keys. Google says to treat that as a critical security event. On Google Cloud, inference logs are off by default; Google says to enable Data Access logs for Vertex AI and alert on the EnableService call.
Get secrets out of your repos. Scan GitHub for keys and tokens, move them to a secrets manager and rotate them. Hosting platforms leak keys too, as the Northflank breach showed. If you run LiteLLM, check its security advisory for CVE-2026-40217 and patch. This is the same lesson as the backdoored Claude Code extension in Cursor’s marketplace last week: developer machines and repos hold keys worth stealing.
Use phishing-resistant MFA. Google recommends it across cloud consoles, identity providers and developer platforms. It won’t stop a pasted session token, so train people never to paste tokens or JSON payloads into a web page that asks for them.