Google research: 'LLMjacking' costs businesses up to $1 million
Google's Threat Intelligence Group (GTIG) and Mandiant documented 'LLMjacking' attacks, where criminals steal API keys for cloud AI services and resell access through so-called 'LLM mixer' services. Researchers identified two coordinating threat clusters, one scanning for publicly exposed LLM endpoints and another stealing valid API keys from unprotected systems, with request volumes sometimes spiking past 1,000 per second. The fraudulent usage lands on the victim's bill because the cloud provider records it as legitimate consumption, with some organizations seeing charges exceeding $100,000 in a single day and cumulative costs reaching $1 million. For any business using API keys to access AI models through the cloud, the case shows that controlling access to those keys is now just as critical as controlling banking credentials.
Sources
This summary was written automatically with AI from the public sources listed above and checked by an independent AI reviewer before publication. For full details, read the original source.