Google says attackers are stealing enterprise access to large language models and running up cloud bills through a tactic it calls LLMJacking. In incidents Mandiant investigated in 2026, fraudulent resource charges exceeded $100,000 in a single day. Cumulative charges reached $1 million at some organizations before access was revoked.
The incidents affected organizations in North America, South America and Asia Pacific across financial services, retail, technology and transportation. Google says attackers targeted cloud and model resources from a range of providers.
In multiple investigations, attackers first gained access through exposed or stolen cloud identity tokens, including service account keys, IAM credentials and active session tokens. Some also used LLM API keys found in public code repositories. Once inside, attackers searched for more credentials, expanded their permissions and created accounts or keys to keep access.
Attackers resell access to stolen model capacity
Google says some attackers used the stolen access to run large volumes of model requests or provision GPU-equipped cloud instances. Others routed requests through services Google calls “LLM Mixers,” which pool compromised credentials and resell unauthorized model access.
In one case, Google observed an attacker make more than 500,000 LLM API calls in less than eight hours using stolen third-party API keys. The calls powered a token routing service called Jet Night and passed nearly $1 million in token costs to the victim organization, according to Google.
Google points defenders to account changes
Google advises organizations to watch for unauthorized changes to LLM accounts and services. Mandiant found that LLM services were disabled at the time of compromise in multiple incidents, then enabled by attackers using abused access keys. Google Security Operations customers can access related detection rules through the Cloud Threats, Mandiant Frontline Threats and Mandiant Hunting Rules rule packs.
