Google says LLM hijacking drove $1 million cloud charges

Google Threat Intelligence Group and Mandiant said they had analysed incidents in which LLM hijacking produced fraudulent cloud charges. They said some victims faced more than $100,000 in a single day, and some organisations accumulated charges of $1 million.

The researchers said there were two main groups of attackers: one scanned for exposed LLM endpoints, while the other stole valid API keys from unprotected machines. After access was gained, it was sold on through LLM mixers that relayed customer prompts through hijacked services and billed the victim.

Google cited Jet Night and newapi[.]pro as examples of relaying infrastructure. It said one actor made more than 500,000 API calls in less than eight hours using stolen third-party keys, and that Jet Night passed nearly $1 million in token costs to the victim.

The company also identified UNC6993, which it said used gateway tools to collect stolen keys and distribute requests, and likely sold access through underground forums. It said attackers used exposed or compromised cloud credentials, service account keys, GitHub tokens, active session tokens and LLM API keys.

Researchers said they had also seen exploitation of CVE-2026-40217 in LiteLLM, and in some cases attackers used victim cloud infrastructure to host proxy endpoints and agentic workloads. Google recommended stronger identity and access management, secret rotation, phishing-resistant multi-factor authentication, monitoring, spending limits and logging.