Artificial Intelligence · Cybersecurity
Google warns of LLMjacking costs reaching $1 million
Google said attackers had been hijacking enterprise LLM access through stolen or exposed credentials, with some incidents producing six-figure daily charges and a separate relay service rerouting coding tools through third-party servers.
- Google said on Monday that attackers had been using access to enterprise LLM accounts to consume compute and AI services at the owner's expense.
- Google Threat Intelligence Group and Mandiant said incidents had been seen in North America, South America and Asia Pacific, mainly across financial services, retail, technology and transport.
- They said some individual cases had passed $100,000 in daily charges and had reached $1 million before access was revoked.
- The article also cited Symantec and Carbon Black saying a relay service had installed legitimate OpenAI Codex and Anthropic Claude Code tools and redirected requests through other infrastructure.
Google said on Monday that attackers had been using stolen or exposed access material to enter enterprise LLM accounts and leave the bill with the victim. It said the activity included phishing, leaked source code, misconfigured environments and exposed client-side code.
The company said the incidents stretched across North America, South America and Asia Pacific, and touched financial services, retail, technology and transport. Google Threat Intelligence Group and Mandiant said some cases produced more than $100,000 in charges in a single day, while some organisations reached $1 million before the access was cut off.
Google identified UNC6993 as one group involved and said it had entered a cloud instance through a misconfigured Service Account key. It then used a page posing as an application portal to collect active tokens, and Google said the group also created extra API keys to expand its use of victim cloud projects.
The article also described a separate service found by Symantec and Carbon Black. They said it had installed genuine OpenAI Codex and Anthropic Claude Code CLIs, then changed their settings so requests were routed through third-party infrastructure; the report said it had been active since at least early 2026 and had not shown signs of prompt theft or altered answers.
Named in this story
Companies
- warned about LLMjacking
- Symantec
- reported on the relay service
- Carbon Black
- reported on the relay service
- OpenAI
- provided the Codex CLI used in the relay service
- Anthropic
- provided the Claude Code CLI used in the relay service
Organisations
- Google Threat Intelligence Group
- co-authored the report
- Mandiant
- co-authored the report
- UNC6993
- was cited as a threat actor that used a misconfigured cloud key
Products and systems
- Jet Night
- offered resale access to unauthorised LLM use
- LiteLLM
- had a vulnerability Google said was exploited
Places
- North America
- was among the regions where affected entities were located
- South America
- was among the regions where affected entities were located
- Asia Pacific
- was among the regions where affected entities were located
- Mainland China
- was among the regions targeted by the relay service
- South Korea
- was among the regions targeted by the relay service
- Taiwan
- was among the regions targeted by the relay service
- Malaysia
- was among the regions targeted by the relay service
How the source tells it
The piece read as a threat-intelligence brief, with a sober register punctuated by alarm over large cloud bills and warnings of wider adoption.
- alarm large charge figures and a comparison with cryptojacking
- urgency forecast language that attackers would increasingly prioritise the tactic