Hackers are running up huge AI bills on other companies' accounts

Google has warned that criminals are breaking into company AI accounts and using them for free, while the company that owns the account gets the bill. The practice is called LLMjacking. At some organizations, fraudulent charges passed $100,000 in a single day. At others, the total reached $1 million before access was shut off.

What happened

An LLM, or large language model, is the technology behind AI chatbots and writing tools. Businesses often connect to these models using an API key, which works like a password that software uses. If a criminal gets that key, they can use the AI service as if they were the company.

Google's threat teams and Mandiant said the keys are stolen in several ways: phishing, leaked source code, misconfigured systems, and code exposed on websites. Some keys were found in public GitHub repositories. Google compared it to cryptojacking, where criminals secretly use a victim's computing power. The difference is speed. LLMjacking can create huge charges within hours.

How the scheme works

Once inside, attackers move quickly. Google says they try to gain more access, dig deeper into the network, and look for more credentials. One group, tracked as UNC6993, created extra keys inside victim accounts and ran up more than $100,000 in charges.

There is also a resale market. Google describes services it calls LLM Mixers that pass stolen AI access to other criminals. One, called Jet Night, offers an unlimited plan with access to a top-tier model for about $60 a month. Separate research from Symantec and Carbon Black describes a relay service that reroutes AI coding tools through third-party servers.

Who it affects

Any organization that pays for cloud AI services could be a target. Google saw victims in financial services, retail, technology and transportation, across North America, South America and Asia Pacific. A company that does not use cloud AI tools or API keys has little to worry about from this particular scheme.

What to do

The alert box above lists the steps. The short version: keep keys out of public places, cap spending, and clean up old access. Treat a surprise spike in AI usage as a possible break-in, not just a billing quirk.

What is not known

Google did not say how many companies were hit overall, and the report names no victims. The material also does not say whether any of the lost money was recovered.