Attackers are hijacking enterprises' access to large language models using stolen cloud credentials, racking up cloud charges that in some cases reach $1 million, according to Google.
CLOUD SECURITY · AI RESOURCE ABUSE
Stolen cloud keys are being used to run up AI bills, with some enterprise charges reaching $1 million
Attackers call this "LLMjacking": they gain access to AI model resources with valid cloud credentials, consume them at the victim's expense, and resell the access in underground markets.
$1M
Cloud charges reported in some cases, as a maximum for some enterprises
Resold
Compromised access is sold on underground marketplaces to other criminals
Scale of the reported maximum
Each block = $100,000. Ten blocks = $1,000,000 (a maximum for some enterprises, not a typical loss).
$1,000,000
A single compromised key can translate directly into a large, unexpected invoice, and the account owner may not notice until the charges arrive.
How the abuse unfolds
STEP 1
Obtain valid cloud credentials
→
STEP 2
Access AI model resources
→
STEP 3
Consume at the victim's expense
→
STEP 4
Resell access to other criminals
Controls that limit the damage
Keep cloud keys out of code repositories
Rotate credentials regularly
Enforce least-privilege access
Set budget alerts and usage quotas on AI services
What the figures do not tell us
The $1 million figure is a maximum, not a typical loss
Affected cloud providers, models and industries are not specified
The time period of the activity is not specified
THE TAKEAWAY
AI consumption should be treated as a sensitive security asset, not only as a billing issue.
Continue reading The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.
Already purchased? Sign in ✓ Signed in — this article isn’t included in your current plan.Unlocking the full article...