Somebody steals an API key, starts running inference at volume with it, and the bill lands on your desk. That's LLMJacking, and Google has just put some frightening numbers on it.
What happened
On Monday, Google's Mandiant incident response team and its threat intelligence group published a report on the theft of access to cloud models. The Register covered it. The hard numbers:
- Fraudulent charges that can exceed a hundred thousand dollars in a single day.
- At some organisations the running total reached a million dollars before the victim revoked access.
- A group Google tracks as UNC6993 got in with someone else's API keys, generated fresh keys, switched on services inside the victim's cloud projects and left a hundred thousand dollars on the invoice.
- Another intruder made more than 500,000 API calls in under eight hours using stolen third-party keys, feeding a token resale service called Jet Night.
- CrowdStrike documented an extreme case in August: roughly 200,000 API requests in two minutes.
The modus operandi is worth reading slowly. One of the thieves subscribed victim accounts to pay-as-you-go so they could reach advanced models, picked the expensive ones, launched high-volume inference and used what the report calls a "burn and rotate" approach: creating and deleting short-lived service accounts to dodge rate limits. And all the while, they checked the victim's billing interface to watch the financial damage add up. The attacker audits your invoice before you do.
Another detail: they built a page impersonating a sign-up portal for a group of model users, asking people to paste the JSON payload containing an active token. That got them past both password and second factor, because the token had already been issued.
There's also a division of labour: some crews obtain the initial access — in one mid-2026 case, a misconfigured service account key — and others, which Google calls LLM Mixers, handle the downstream monetisation.
"Whenever they can, attackers want to use this technology to gain a scale advantage over defenders," John Hultquist, chief analyst at Google's threat intelligence group, told The Register.
Why it matters
Inference has become a stealable resource, the way CPU time was for crypto mining. But two differences make it worse.
The first is accounting. AI spend is a brand new line in almost everyone's budget, and hardly anyone has a baseline for what normal looks like. A CPU spike on a box that always sits at 5 % stands out. An AI project that jumps from two thousand to twenty thousand in a month looks an awful lot like "the team has started using it properly". That ambiguity is exactly the hiding place an attacker needs.
The second is speed. Two hundred thousand requests in two minutes and half a million calls in eight hours mean that an alert reviewed the next morning, or a cost report you look at when the month closes, arrives late by several orders of magnitude.
What someone should do differently from today:
- A hard spending cap per project and, if your provider allows it, per key. Not an alert: a cut-off.
- Alerts by amount per hour, not amount per month.
- A separate cloud project for AI, with its own billing. What isn't mixed in can be seen.
- Secrets in a central manager — Secret Manager or equivalent — with automatic rotation, plus secret scanning in your codebases to pull out the keys somebody pasted into a repository eighteen months ago.
- Real least privilege on service accounts: who can mint new keys, and who can enable paid services inside the project. That permission is what turns a small intrusion into a million dollars.
What doesn't change
Let's be fair to the story. A hundred thousand dollars a day is the extreme case, not the average; the headline puts it where it hurts most. And none of this is a new flaw: there's no hole in the model APIs or in the models themselves. It's good old credential theft aimed at an expensive resource, running the same playbook as cryptojacking five years ago, with the same boring countermeasures the report itself recommends.
The Jet Night part is a deduction, not a confession: Google concludes it runs on stolen keys because an unlimited plan at roughly sixty dollars a month doesn't add up when the legitimate equivalent sits somewhere between one hundred and two hundred and fifty. Reasonable, but still inference. The stronger clue is elsewhere: the service itself has been admitting outages on its public Telegram channel, consistent with victims discovering the compromise and revoking keys.
And if your cloud is already locked down, you rotate secrets and there are no keys in your code, this news doesn't force you to do anything new. It forces you to check that it's true.
Our take
The most interesting thing in the report isn't the money: it's the page asking people to paste a JSON payload with a token inside. We've spent years saying "turn on MFA" as if that were the end of the road, and here the attacker doesn't even try. He goes straight for the already-issued token, which is a password by another name, usually lives longer than it should, and almost nobody rotates. If your mental model of identity stops at the login screen, you're already behind.
And I think it's wrong — said kindly — that this is being framed as an "AI danger" story. It isn't an AI problem. It's an identity and secrets management problem where AI has only set the price: the stolen unit went from being worth pennies to being worth pounds per minute. Anyone with decent IAM sleeps as well as they did last week; anyone without it will find out via the invoice.
My bet is that this ages like cryptojacking: in a year it'll be routine, it'll stop being news, and it'll keep happening, because the bottleneck is never knowing what to do, it's someone actually getting round to doing it. And one detail worries me more than the spend: a key of yours used to attack third parties leaves a trail pointing at your organisation. The money you argue about with your provider; the attribution, you don't.
If I had to pick one measure for tomorrow, it'd be the hard per-project spending cap. Not because it's the best defence — it isn't — but because it's the only one that works once everything else has already failed, and it turns a million dollars into a ticket.
This is exactly what we run into when we go in to tidy up the cloud of someone who's spent a year wiring AI into their processes: the model works, nobody is watching the cost, and the keys are in four places no one remembers any more.
Any questions, tell me and we'll look at it.
Best, Vicente.