Google has reported that attacks known as LLMjacking have generated about $1 million in charges on cloud AI services, a sign that criminals are increasingly exploiting stolen access to commercial AI platforms.
Cloud security · LLMjacking
Stolen AI access has already racked up about $1 million in charges
Criminals are exploiting valid cloud credentials to run large language models at someone else's expense. The costs land on the account owners, not the AI providers.
$1M
Reported charges from LLMjacking on cloud AI services
Victim
The account holder pays for requests the attacker sends
Keys
Leaked credentials or misconfigurations give attackers entry
How the abuse unfolds
A four-step flow from stolen access to unexpected bill
STEP 1
Obtain credentials
Leaked keys or misconfigured systems
→
STEP 2
Send model requests
Valid access to commercial LLM services
→
STEP 3
Charges accrue
Billed to the compromised account
→
STEP 4
Victim notices
Costs may build up before detection
The $1 million at scale
Each block represents $100K of the reported total. Illustrative scale only; the time period and breakdown were not reported.
Takeaway: A single reported figure can hide a lot. The total is large enough to matter for any team running cloud AI, but the number of affected organizations and the platforms involved have not been confirmed.
Defensive priorities
Treat AI service credentials like any other privileged access
Rotate keys
Replace credentials on a regular schedule
Restrict permissions
Limit what each key can call
Watch for spikes
Monitor usage and cost for unusual activity
Continue reading The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.
Already purchased? Sign in ✓ Signed in — this article isn’t included in your current plan.Unlocking the full article...