LLMjacking: Stolen API Keys, Up to $1 Million Charged

Intrusions into cloud environments allow groups to resell the use of AI models while charging victims. Cases tracked by Google and Mandiant show bills reaching $1 million and unprecedented query rates. One service, Jet Night, takes advantage of stolen keys resold through API "mixers."

Costs in a Single Day Exceeding $100,000

Reported financial consequences are swift and substantial. According to Google, some incidents have generated over $100,000 in fees in a single day, and in a few situations, the cumulative amount reached $1 million before access was revoked. A case documented by the Google Threat Intelligence Group mentions over 500,000 API requests made in less than eight hours to fuel Jet Night, resulting in nearly $1 million in token-related expenses. BleepingComputer also reports usage spikes exceeding 1,000 requests per second.

Illicit and Cheap Subscriptions Fueled by Stolen Access

Underground platforms, the LLM Mixers, aggregate stolen API keys, distribute loads across multiple accounts, and offer access to various AI models while masking the company that is actually billed. Google has identified Jet Night, which markets subscriptions that present themselves as access to advanced models, with an unlimited plan around $60 per month. Google estimates that comparable access at market rates would cost between $100 and $250 monthly. Requests from these customers pass through compromised infrastructures and are recorded as normal consumption by cloud providers, then billed to the victims.

How Intruders Infiltrate and Expand Their Rights

LLMjacking relies on capturing access to AI models hosted in the cloud. Attackers target exposed API keys, stolen credentials, and still-valid tokens, which act as entry keys to services. Google researchers have also spotted publicly accessible services that are insufficiently protected. Some perform automated checks of stolen keys by sending very short requests, sometimes with just a single token. Once they gain access, they launch AI services, create new keys, escalate their rights, and explore repositories, databases, and secret stores to seize additional sensitive data.

Industrializing Abuse: Ephemeral Accounts and Dedicated Relays

To extend their operations, groups continuously create and delete temporary service accounts to bypass usage limits and deploy intermediary servers that distribute requests. Google has identified teams using compromised cloud infrastructures to host AI agents as well as relay systems, which are then used to provide unauthorized access to various models. This shift of attackers from cryptojacking to exploiting AI models is explained by costs that can escalate rapidly, unlike traditional mining.

Reducing Exposure and Preparing a Response

Google recommends strictly limiting rights through tight identity and access management, centralizing and renewing API keys, and automating the detection of exposed credentials in code repositories. Enabling phishing-resistant multi-factor authentication and monitoring for abnormal connections are advised, as well as setting spending caps and API quotas to contain the impact of a compromised account. Cloud activity logs should be enabled and monitored, as a sharp increase in requests, the unexpected activation of an AI service, or the creation of new administrators could signal an intrusion. Google anticipates a rise in LLMjacking with the proliferation of premium models and autonomous agents in enterprises. In 2026, the Google Threat Intelligence Group and Mandiant documented several attacks of this type, illustrating a well-established threat that imposes costs on victims that can reach $1 million.