Google reports attackers running up $1 million LLM bills

Google Threat Intelligence Group (GTIG) says it investigated multiple “LLMJacking” incidents in 2026, in which attackers hijacked organisations’ access to cloud-based large language models (LLMs). The affected organisations were in North America, South America and Asia Pacific, across financial services, retail, technology and transport.

Mandiant observed fraudulent usage charges exceeding US$100,000 in a day in individual incidents, with cumulative bills reaching US$1 million at some organisations before access was revoked.

Attackers most often gained entry with exposed or stolen cloud identity tokens, including IAM credentials, service account keys, GitHub personal access tokens and active session tokens. They also harvested exposed LLM API keys and targeted publicly accessible model endpoints. After breaking in, they searched cloud services, code repositories and data stores for further credentials, and in some cases created unauthorised accounts or injected SSH keys to maintain access.

One attacker exploited a user ID rebind flaw in LiteLLM’s `/key/regenerate` endpoint, CVE-2026-40217, to turn standard Virtual Keys into administrator credentials.

GTIG says attackers monetised stolen access by running high-volume model requests, provisioning GPU instances and routing or reselling access through “LLM Mixers” — proxy services that pool credentials and obscure where requests originate. In one case, an attacker made more than 500,000 API calls in under eight hours, with nearly US$1 million in token costs charged to the victim.

GTIG recommends monitoring for unauthorised activation of LLM services and unusual API use, and advises organisations to protect and rotate credentials, limit permissions, scan code for exposed secrets, set usage and spending limits, and patch model-routing gateways.