Google has warned that criminals are hijacking companies' access to large language models and reselling it on the underground market, leaving victims with cloud bills of more than $100,000 in a single day and up to $1 million in total. The warning comes in a report published on 2 November by Google's Threat Intelligence Group and its Mandiant incident-response team, based on cases Mandiant handled during 2026.

The tactic is called LLMjacking. Instead of stealing data or encrypting files, attackers take over an organisation's paid access to AI models and burn through its cloud budget running expensive computations. Unlike cryptojacking, which quietly drains computing power over weeks or months, LLMjacking can produce a huge fraudulent bill within hours, and the victim only discovers it when the invoice arrives.

The way in is usually ordinary credential theft. Google found the most common route was exposed or stolen cloud identity tokens: IAM credentials, service account keys, GitHub personal access tokens and active session tokens. Once inside, attackers escalate privileges, search code repositories and secret stores for more credentials, and create new API keys to scale up their use of the victim's AI services.

One cluster Google tracks as UNC6993 shows how quickly the damage mounts. In mid-2026 it broke into a cloud instance through a misconfigured service account key, then used that foothold to reach an LLM API. It created extra API keys inside the victim's cloud project and ran up more than $100,000 in charges. The same group also ran a fake web page posing as a portal for joining a group of AI users, tricking people into pasting a raw access token from the genuine AI service, a trick that bypassed both passwords and multifactor authentication.

In at least one case, attackers exploited a flaw in LiteLLM, an open-source gateway used to route requests to AI models, tracked as CVE-2026-40217, to escalate their privileges once inside a victim's environment.

The stolen access does not just get used, it gets sold. Google describes a maturing criminal supply chain, with specialist middlemen it calls LLM Mixers: illicit routing gateways that proxy, aggregate and resell unauthorised model access through underground storefronts. One such service, Jet Night, advertises an unlimited token plan with claimed access to a frontier model for about $60 a month. In one case Google examined, an actor using stolen third-party API keys made more than 500,000 LLM API calls in under eight hours to power the service, passing nearly $1 million in token costs to the victim organisation.

A separate grey-market relay, described in research from Symantec and Carbon Black, takes a different route to the same end. It installs the genuine OpenAI Codex and Anthropic Claude Code command-line tools on enterprise systems, then rewrites their configuration to switch off the execution sandbox and route every request through its own servers. The service has been active since at least early 2026, mainly affecting organisations in mainland China and multinational subsidiaries in South Korea, Taiwan and Malaysia.

The victims Google identified span financial services, retail, technology and transport, across North America, South America and Asia Pacific. Google has not published a total count of victims, and the dollar figures come from individual cases it investigated rather than an average across all incidents.

Google expects the problem to grow. "Threat actors will increasingly prioritize LLMJacking over traditional resource theft like cryptojacking, driven by the immediate, high-margin monetization enabled by emerging underground LLM Mixers," the report says, adding that criminals will probably refine automated searches for exposed API tokens and flaws in model-routing software as more companies put higher-tier models and AI agents into production.

The defences are the unglamorous basics: lock down service account permissions, rotate API keys, watch cloud billing for sudden spikes, audit who can create new keys, and patch AI gateway software such as LiteLLM. The cost of a stolen key is no longer measured in data lost, it is measured in the bill that arrives before anyone notices.