Google warns of $1 million cloud bills from AI access theft

How the attack worked

Attackers are breaking into corporate cloud accounts and stealing access to AI models, according to Google’s Threat Intelligence Group (GTIG) and Mandiant researchers, as reported by Help Net Security↗ (opens in a new tab) and BleepingComputer↗ (opens in a new tab). This method, called "LLMjacking", involves hijacking credentials or API keys that let companies use large language models (LLMs) in the cloud. Once inside, attackers either use the access themselves or resell it through underground services known as LLM mixers.

In one case, a threat actor used stolen API keys to make over 500,000 calls to AI models in less than eight hours, resulting in nearly $1 million in charges for the victim. Attackers often gain access by finding exposed credentials, such as service account keys, GitHub tokens, or active session tokens. Sometimes, they exploit vulnerabilities, like CVE-2026-40217 in the LiteLLM gateway, to escalate their privileges and control AI resources.

LLMjacking differs from older attacks like cryptojacking. Instead of slowly using up computing resources, LLMjacking can create huge spikes in cloud bills within hours. Attackers set up proxy services to relay requests from paying customers to the hijacked AI models, leaving the original company to foot the bill.

Who is affected

The incidents reported by Mandiant in 2026 targeted organisations in financial services, retail, technology, and transportation across North America, South America, and Asia Pacific. Victims faced sudden, massive increases in cloud charges, sometimes exceeding $100,000 in a single day and up to $1 million before the attack was stopped.

What was taken

The main target is access to cloud-based AI models, not traditional personal data. Attackers steal credentials and API keys that allow them to run expensive AI workloads. In some cases, they also search for other sensitive information, such as database credentials and administrator passwords, within compromised environments.

The response

Google’s researchers recommend several defences. First, companies should use strong identity and access management (IAM) controls and centralised secrets management to protect keys and credentials. Monitoring for changes to AI accounts and services is critical, as attackers often activate or modify services to start the fraud. Enforcing phishing-resistant multi-factor authentication (MFA) and setting strict API usage and spending limits can help detect or prevent these attacks. Google also advises enabling and monitoring cloud audit logs for suspicious activity, such as unexpected service activations or large spikes in usage.

What you should do

Organisations using cloud AI should regularly review who has access to AI resources and rotate credentials frequently. They should check for exposed keys in code repositories and ensure that only necessary permissions are granted. Setting up alerts for unusual spending or API usage can help catch attacks early. Finally, patching known vulnerabilities, such as CVE-2026-40217 in LiteLLM, is essential to prevent attackers from escalating their access.