Google: LLMjacking attacks rack up $1 million in cloud AI charges
Story 5, from BleepingComputer
LLMjacking attacks are generating massive fraudulent cloud charges, with some organizations losing over $1 million. Attackers exploit stolen API keys to resell access to LLMs, leading to unauthorized usage and billing.
Key points
- LLMjacking attacks use stolen API keys to monetize enterprise LLM infrastructure, generating fraudulent charges up to $1 million.
- Threat actors scan for exposed LLM endpoints or steal API keys, then resell access through services like Jet Night and newapi[.]pro.
- Attackers can execute over 500,000 API calls in hours, leading to massive token costs being billed to victims.
- CVE-2026-40217 in LiteLLM allows arbitrary code execution, aiding attackers in hijacking LLM services.
- Google recommends securing IAM, rotating secrets, and monitoring for shadow AI and unauthorized service activation.
- Threat clusters like UNC6993 use gateway tools to aggregate stolen keys and distribute requests through underground forums.
Why it matters
Software engineers must secure cloud AI infrastructure against LLMjacking, which can lead to massive financial loss and unauthorized use of resources. This highlights the need for strong IAM, secret management, and monitoring practices.
Counterpoint
The report focuses on cloud infrastructure and API key security, but does not provide specific guidance on mitigating LLMjacking in on-premises or hybrid environments.
Sources
- Google: LLMjacking attacks rack up $1 million in cloud AI charges (BleepingComputer)
This summary was written by a language model and may contain errors. Read the original for the full story.