What Is LLMjacking? How Hackers Hijack AI Accounts and Cause Massive Cloud Bills

LLMjacking is when attackers steal your AI API keys or cloud credentials and run large language models on your account. They get free AI access to use or resell. You get the bill. Google Threat Intelligence Group and Mandiant saw fraudulent charges above $100K in a single day and cumulative bills near $1 million at some victims. Any team that pays for AI by usage is a target. That includes a three person startup with one key and a big company with hundreds of service accounts. The fix is mostly basic hygiene. Rotate keys. Set spending caps. Scan for leaked secrets. Turn on MFA. This guide explains how LLMjacking works and what it costs and how to detect and prevent it before your next invoice lands.

What Is LLMjacking?

LLMjacking is the abuse of stolen access to large language models. An attacker takes over a cloud account or grabs an AI API key. Then they run models on your account and you pay for every token.

Sysdig researchers coined the term in May 2024. Back then it looked like a niche trick. In 2026 it became a real business. Mandiant handled several incidents this year across financial services and retail and technology and transportation.

Think of it as a stolen credit card with no limit. The card is your cloud account. The limit exists only if you set one.

LLMjacking attacks usually target hijacked cloud AI accounts on AWS Bedrock and Azure Cognitive Services and Google Cloud (Gemini API). The common thread is unauthorized LLM access that you pay for.

How Does LLMjacking Work?

Mandiant describes a clear attack path. Most incidents follow the same steps:

1. Get access: The attacker finds an exposed LLM endpoint or steals an API key or a cloud identity token.
2. Test the key: They send tiny requests with a single token. This confirms the key works without triggering volume alerts.
3. Expand control: They create new service accounts and access keys. Some add SSH keys to virtual machines to stay in.
4. Turn on AI services: In several incidents the LLM service was not enabled at the time of compromise. Attackers enabled it themselves.
5. Burn through quota: One actor signed victim accounts up for Pay As You Go plans on premium models. Another used a “burn and rotate” method that created and deleted short lived service accounts to get around rate limits.
6. Sell or reuse the access: More on that below.

Can attackers bypass API usage caps? Sometimes. A limit tied to one identity does not help when the attacker keeps making new ones. That is why billing level spending caps and alerts matter.

How Do Hackers Get Access to AI Accounts and API Keys?

Google says the dominant entry point is exposed or stolen cloud identity tokens. These include IAM credentials and service account keys and GitHub personal access tokens and active session tokens. Most of these are nonhuman identities. Nobody types a password for them so nobody notices when they leak.

Common routes:

• Keys in public code: One actor harvested corporate LLM API keys exposed on GitHub. Stolen AI API keys often start as a careless commit.
• Misconfigured service account keys: UNC6993 broke into a cloud instance this way.
• Session token hijacking: A fake application portal told users to paste a raw JSON token. That bypassed passwords and MFA.
• Compromised IAM credentials: One attacker used cloud federation tokens to create fresh access keys and go around MFA.
• Exposed endpoints: Open Ollama servers let attackers register their own models.
• Vulnerable gateways: A flaw in the LiteLLM gateway (CVE-2026-40217) let attackers turn standard virtual keys into full admin credentials.
• Malvertising: Wiz found search ads that led to fake Google login pages. Attackers then took over billing accounts and linked their own projects to the victim.

Old code bugs help attackers too. Our PHP2Shell explainer shows how long a flaw can sit unnoticed.

How Attackers Monetize Hijacked AI Access

Stealing access is only half the business. GTIG noticed a division of labor. One group breaks into environments. Another runs LLM Mixers that collect stolen access and resell it to underground subscribers. These gateways pool keys and meter usage and hide where requests come from.

Jet Night is one example. It offers an unlimited plan for about $60 a month. A comparable legitimate subscription costs $100 to $250. GTIG believes the service only turns a profit because the keys are stolen. Jet Night also posted outages on Telegram. Those likely happened as victims found the leak and revoked keys.

One actor feeding Jet Night with stolen keys made more than 500K calls in under eight hours. The victim was left with nearly $1 million in token costs. UNC6993 used open source gateway tools to spread load across stolen accounts. Another actor fed the newapi.pro resale ecosystem.

Some attackers skip resale. They run their own agents or spin up GPU servers on your account. GTIG expects LLMjacking to replace older resource theft like cryptojacking.

How LLMjacking Differs From Cryptojacking and Credential Theft

Cryptojacking steals compute to mine coins. The cost climbs slowly. Google notes that LLMjacking can create large spikes in fraudulent cloud charges within hours. Credential theft is broader. It covers stolen logins and often ends in data theft or account resale. In LLMjacking the stolen credential is just the way in. The payoff is AI compute.

Attack	What gets stolen	Main goal	How fast costs rise
Cryptojacking	CPU or GPU time	Mine coins	Slow and steady
Credential theft	Logins and tokens and data	Data theft or account resale	Varies by case
LLMjacking	AI API keys and cloud identities	Run or resell LLM access	Hours

A quick rule: if your bill creeps up check for miners. If it jumps overnight check your AI services first.

What Does LLMjacking Cost Victims?

The numbers are large and they arrive fast:

• Up to $1 million: Cumulative fraudulent charges at some organizations before access was revoked.
• $100K+ in one day: Seen by Mandiant in individual incidents.
• Nearly $1 million in under eight hours: The Jet Night case with 500K+ API calls.
• $180 to $82K in two days: A three person team saw its usual Gemini spend of about $180 a month jump to $82,314 after a suspected stolen key. The IBM Security Intelligence podcast covered this case.
• Tens to hundreds of thousands in 24 to 48 hours: Wiz reported this range for billing account hijacks.

Now compare that with the cost of defense. Many controls are built into your cloud console or code host. Budget alerts and spending caps and key rotation and secret scanning take hours to set up. Small teams have the most to lose. The startup in the Gemini case reportedly asked for a write off and was told the amount would not be reviewed before payment.

How to Detect and Prevent LLMjacking

How to Detect LLMjacking

• Daily budget alerts: Set budget alerts for AI API usage at a daily level. Monthly alerts fire too late.
• Enablement alerts: Alert on unexpected enablement of any LLM service. Mandiant says to treat it as a critical event.
• Audit logs monitoring: Watch AWS CloudTrail for Bedrock calls such as InvokeModel. On Azure watch the Microsoft.CognitiveServices namespace. On Google Cloud turn on Data Access logs for AI endpoints because they are off by default.
• Model gateway log monitoring: Flag tiny test requests with a single token. They often come before a big attack.
• Identity changes: Alert on new IAM users and service accounts and SSH keys. Treat any change to logging settings as high risk.

How to Prevent LLMjacking

Here is how to protect AI API keys:

1. Use secrets management: Store keys in a vault and rotate them on a schedule. Rotation shortens the life of a leaked key.
2. Turn on secret scanning: Scan GitHub and GitLab repos so leaked keys are caught fast.
3. Apply least privilege access: Deny LLM permissions to any user or service account that does not need them.
4. Enforce phishing resistant MFA: Cover cloud logins and consoles and developer platforms.
5. Set usage and spending caps: Split keys by model and environment so a dev key cannot call a costly model.
6. Patch gateways quickly: Tools like LiteLLM need the same patch discipline as any server. Weak basics cause big gaps as the CFPB cybersecurity audit story shows.
7. Inventory nonhuman identities: AI agents add more keys and permissions. Our piece on the Claude Duet AI agent shows how quickly these tools spread.

What to Do After an API Key Leak

1. Revoke and rotate the key right away.
2. Disable LLM services you do not use.
3. Review audit logs for new accounts and keys and logging changes.
4. Contact your cloud provider about the charges.
5. Add caps and alerts before you restore service.

Bottom Line

LLMjacking turns a small leak into a huge bill within hours. The defense is not complicated. Rotate keys and scan for secrets and limit permissions and cap spending and watch your logs. AI abuse is spreading in other ways too. Our report on AI deepfake apps exposed shows how fast bad actors move.

Frequently Asked Questions

What is LLMjacking?

LLMjacking is the theft of access to large language models. Attackers use stolen API keys or cloud credentials to run AI models on your account and you pay the bill. Some also resell that access.

How is LLMjacking different from cryptojacking?

Cryptojacking steals compute to mine coins and costs rise slowly. LLMjacking steals AI access and can create huge charges in hours. It also feeds an underground resale market.

How do attackers steal AI API keys?

Mostly through leaked code and misconfigured service account keys and session token hijacking and phishing. Attackers scan public GitHub repos for exposed keys. They also exploit flaws in gateways such as LiteLLM.

How do I know if my AI account was hijacked?

Look for sudden spikes in usage or spend and LLM services you never enabled. Check audit logs for new service accounts and unfamiliar API calls and changes to logging. Budget alerts give the earliest warning.

What should I do if I get a huge cloud bill?

Revoke and rotate all exposed keys and turn off AI services you do not use. Then review audit logs and contact your cloud provider about the charges. Add spending caps before you restore access.