What Is LLMjacking? How Stolen AI Access Is Used, Resold and Billed to You, What It Has Cost, and the Five Controls That Cap the Damage
LLMjacking is stealing someone's access to hosted AI models so the thief's workload runs on the victim's bill. The most useful thing you can do about it today is set a spending cap and an alert on every AI service your organization has turned on, because the bill is usually the first symptom and it arrives after the money is gone. This page explains how it works, what it has cost, how to spot it and how to stop it, using three cases we covered this autumn. We have called the category token theft: theft of metered AI capacity, not of data.
What is LLMjacking?
Attackers get hold of a credential that can call a cloud or model service, spend the owner's money on large models, and often resell the capacity. Google's Threat Intelligence Group and Mandiant described it on November 2, 2026 as a business, not a prank: the stolen key is the product, and middlemen sell it on. The victim sees a bill, and often no prompts, because the usage may sit in accounts they cannot inspect.
How does it happen?
Google says the dominant route is exposed or stolen cloud identity tokens, meaning IAM credentials, service account keys, GitHub personal access tokens and live session tokens. The specific routes it describes:
A misconfigured service account key on a cloud instance, used to reach a model API.
A page posing as an application portal that asks the victim to paste a raw access token. That skips the password and the MFA prompt.
A stolen GitHub token used to reach private repositories.
Model API keys harvested from public GitHub repositories and checked with single-token test requests (max_tokens set to 1), which keeps the volume under alert thresholds.
Exposed Ollama endpoints.
Wiz described a different route in October: attackers phished a cloud administrator, attached their own projects to the victim's billing account, and ran Google's Gemini models on the victim's money. The lure was a paid search ad on the words an administrator types, leading to a fake sign-in page that captured the password and the MFA code. The attacker then deleted an organization policy that limits who can be added, made outside accounts billing administrators and demoted the real administrators to read-only. In September, ThreatDown reported a botnet called CARBONATO whose loot list puts AI API keys at the top, above SSH keys and cloud tokens.
How much does it cost?
The numbers are the researchers' own, and they cover cases they chose to show, so they are not averages.
Google: fraudulent charges above $100,000 in a single day, and cumulative charges at some organizations reaching $1 million before access was revoked. A reseller it calls Jet Night made more than 500,000 model API calls in under eight hours and passed nearly $1 million in token costs to one victim organization.
Wiz: charges reached tens to hundreds of thousands of dollars within 24 to 48 hours.
Neither researcher gives a count of victims or a total loss across cases.
Who buys the stolen access?
Google calls the middlemen LLM Mixers: gateways that proxy, aggregate and resell unauthorized model access through storefronts. It names two, jet-night.com and newapi.pro, and says one advertised an unlimited token plan at about $60 a month against a typical $100 to $250 for the legitimate equivalent. It also says attackers pool and meter stolen credentials, and create and delete short-lived service accounts to get around rate limits. The price gap is the tell: a plan that cheap only works if somebody else pays.
How do you spot it?
The signal depends on where the usage lands. If it lands in projects you cannot see, your own usage logs and prompt logging have nothing to show, and what you have is the control plane: the record of who changed policies, keys, members and billing links. Google and Wiz point to these:
A model service enabled for the first time on an old or quiet project.
A new service account or API key with a powerful role created outside your normal process.
An organization policy that limits membership by domain being deleted.
A billing account gaining an administrator or a linked project you do not recognize.
Bursts of requests with max_tokens at 1 or temperature at zero, which is how stolen keys get tested.
How do you stop it?
Five controls would have limited the damage in these cases.
Set budget alerts and granular quotas on every AI service. A cap turns a $1 million bill into a smaller one.
Deny AI services by default and grant them only where needed, scoped by model, environment and usage limit.
Scan your repositories, and your agent settings files, for keys. We published a free scanner for Claude Code settings files, claude-settings-leak-check, after Apiiro reported real secrets in public copies of them. Run it with npx claude-settings-leak-check --root ~/code.
Treat the unauthorized enabling of an AI service, a change to billing administrators and the deletion of an organization policy as critical events.
Use phishing-resistant sign-in, and teach people that a page asking them to paste a token is a theft.
One more habit matters. A key that has leaked stays valid until someone revokes it. Truffle Security reported on November 4 that 81 percent of leaked keys it disclosed in a 2025 study were still valid six months later. Rotate first, then delete.
What we hold
The feed carries the two storefront domains named by Google and the indicator lists from the individual posts below, credited to the researchers who published them. Block coverage is not the same as detection, and we make no claim of an earlier sighting.
Where to read the detail
Our three source posts are "Two Malware Families Handed the Wheel to an LLM This Week. One Spends Inference, the Other Steals It" (September 26), "Attackers Linked Their Own Google Cloud Projects to Victims' Billing and Ran Gemini on Their Money" (October 23) and "Google Put Numbers on LLMjacking: $100,000 in a Day, Nearly $1 Million Before Anyone Noticed" (November 4).
Limits
This is a summary of other people's research, not our own measurement. We did not reproduce any of it, and we did not read Symantec's report that The Hacker News summarized. The cost figures are Google's and Wiz's, for cases they selected. CLOSEDQUORUM, an implant Cisco Talos described that asks commercial models what to do next, has not been confirmed in a real attack, and we do not count it as a loss.
Five percent of this is wrong somewhere. It always is. The numbers will move again before you finish reading.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments