LLMjacking: Stolen AI Keys Can Run Up $100K Bills in Minutes

What is LLMjacking and why is it so expensive?

LLMjacking is the theft of access to large language models—usually through stolen API keys or cloud credentials—so criminals can run their own AI workloads on someone else's bill.

Unlike cryptojacking, where stolen CPU cycles trickle out coins slowly, LLMjacking can burn through cash at startling speed. Google's Threat Intelligence Group (GTIG) reports that one threat actor, UNC6993, accumulated over $100,000 in billing charges after acquiring LLM API access keys.

The attackers don't just use the keys themselves. According to Google, one group subscribed victim accounts to pay-as-you-go agreements, selected premium foundation models, and launched high-volume inference streams. To avoid rate limits, they deployed a 'burn and rotate' strategy—continuously creating and deleting short-lived service accounts while monitoring the cloud provider's billing interface to gauge the financial damage.

The initial foothold often comes from exposed LLM endpoints or stolen cloud identity tokens: IAM credentials, service account keys, GitHub personal access tokens, and active session tokens. From there, attackers escalate privileges and solidify access before monetizing it.

How the LLMjacking ecosystem is evolving

Google says LLMjacking is no longer just a handful of opportunistic hackers. It's becoming a structured market with specialized roles.

GTIG describes a division of labor between groups that establish initial access and 'LLM Mixers'—operators who run routing gateways that proxy, aggregate, and resell unauthorized LLM access to underground subscribers. These mixers use open-source API gateways and custom relay infrastructure to pool stolen credentials, meter usage, and obscure the origin of requests.

In one investigation, Google observed two distinct operational clusters coordinating to compromise and monetize enterprise LLM infrastructure. One actor even rebranded its proxy service under a persona called D1337-KAIROS, deploying a containerized backdoor that queried an upstream LLM to reason through instructions and execute commands locally.

The specialization mirrors what happened with ransomware-as-a-service, but for AI compute. And because frontier models are expensive, the margins for criminals are high.

What should businesses do to protect themselves?

Google recommends increasing visibility into LLM platforms and treating any unauthorized enablement as a critical security event.

The first step is knowing what LLM services are running in your cloud projects. Attackers thrive on shadow AI—unsanctioned API keys and endpoints that IT doesn't monitor. Enforce least privilege so that even if a key leaks, it can't spin up premium models or create new service accounts.

Detection matters too. Set alerts for unusual billing spikes, new service account creation, and changes to LLM configurations. Google suggests auditing billing interfaces for anomalies and monitoring for the 'burn and rotate' pattern of short-lived accounts.

Finally, rotate credentials regularly and avoid embedding long-lived API keys in code repositories. GitHub personal access tokens are a common entry point, so scan for exposed secrets and revoke them promptly. For a deeper look at how AI vendors are tightening their own defenses, see our coverage of OpenAI quadrupling its bug bounties.

• Enforce least privilege on all cloud and LLM accounts.
• Monitor billing dashboards for sudden spikes.
• Alert on new service account creation and LLM service enablement.
• Rotate API keys and scan repositories for exposed secrets.
• Treat unauthorized LLM activation as a critical incident.

What it means for you

If your company uses AI APIs from OpenAI, Google, Anthropic, or cloud providers like AWS, Azure, and GCP, you're a potential target. The risk isn't limited to large enterprises—any organization with exposed API keys or weak cloud identity controls can be hit. The financial damage can appear within minutes, so real-time billing alerts are essential.

There's no specific product to buy here, but security teams should review their cloud IAM policies and API key management practices. Google's report is a wake-up call that AI usage needs the same security rigor as any other cloud resource.

LLMjacking is a young but fast-maturing threat that turns your AI budget into a criminal profit center. Google's warning is clear: visibility, least privilege, and rapid detection are no longer optional. The next six-figure bill could land in your inbox before you even know a key was stolen.