As Google researchers noted this week, attackers can operate inside legitimate cloud accounts, and the first visible indication of compromise may be an extraordinary AI invoice. Google's threat intelligence team says some victims saw more than $100,000 in fraudulent charges in a single day, and one paid for nearly $1 million in eight hours. Known as LLMjacking, the attacks allow criminals to use or resell an organization's AI access while the victim absorbs the cost.

Large language model hijacking attacks, also known as LLMjacking, are generating large fraudulent cloud charges, with some organizations losing more than $100,000 per day.

Introduction: As artificial intelligence models become central to corporate infrastructure, cybercriminals are shifting tactics from traditional cryptojacking to "LLMjacking"—stealing API credentials from public repositories and codebases to run up astronomical cloud computing bills. Beyond credential theft, unauthenticated remote code execution (RCE) flaws in orchestration tools like Langflow and shadow sales integrations are exposing sensitive business environments. Establishing rigorous access controls, real-time rate monitoring, and rapid patch management is essential to safeguard modern enterprise AI deployments.

Cybersecurity researchers have identified a rising trend in 'LLMjacking,' where attackers hijack enterprise AI infrastructure to resell access…

The Hacker News read more about Google Warns LLMjacking Attacks Are Costing Some Enterprises Up to $1 Million in Cloud Charges

LLMJacking is the silent theft of enterprise AI compute. Stolen API keys, tiny probes, and a burner economy that can cost millions before you notice.

Google details LLMjacking attacks that hijack enterprise AI resources, generating fraudulent cloud charges reaching $1 million at some organizations.

Google Threat Intelligence Group et Mandiant alertent sur le LLMjacking, une technique où des attaquants volent des clés API pour utiliser les grands modèles de langage (LLM) des entreprises à leurs frais.

Large language model hijacking attacks, also known as LLMjacking, are generating large fraudulent cloud charges, with some organizations losing more than $100,000 per day.

As faturas fraudulentas em serviços de cloud estão a atingir valores até 1 milhão de dólares (cerca de 888.000 € à taxa de câmbio atual) devido ao roubo de acessos a modelos de inteligência artificial. Os investigadores da Google, através do Google Threat Intelligence Group (GTIG) e da Mandiant, ide

Threat actors have turned reselling cloud access to LLMs into a lucrative business model, with some victims paying $1 million in resource consumption.

Criminals who break into corporate cloud accounts are using the stolen access to run AI models at the victim’s expense, in some cases racking up more than $100,000 in charges in a single day, Google Threat Intelligence Group (GTIG) and Mandiant researchers have found. Usage chart showing LLMJacking generating a spike in API requests (Source: Google) In 2026, Mandiant responded to several of these LLMJacking incidents, recorded in attacks on the financial services, retail, technology …

Large language model hijacking attacks, also known as LLMjacking, are generating large fraudulent cloud charges, with some organizations losing more than $100,000 per day.

Businesses can run up $100,000 bills in minutes

GoogleとMandiantはLLMJackingを分析。認証情報盗用でAPIキーを転売。1日10万ドル超の被害も。対策はAPIキー権限厳格化と機密情報自動スキャンなど。

Large language model hijacking attacks, also known as LLMjacking, are generating large fraudulent cloud charges, with some organizations losing more than $100,000 per day.

This edition covers postal protest surveillance, Moscow school snooping, EU phone cracking, FBI biometrics, cPGuard backdoors, LLMjacking AI bills, WordPress flaws, and AI infostealers.

Criminals resell stolen cloud access to frontier models, hitting some victim organizations with over a million dollars in fraudulent token charges.