Criminals are selling cheap access to powerful AI models, and companies are paying the bill. That is the main finding of a new report from Google Threat Intelligence Group and its Mandiant unit, released on November 2.
The report describes a tactic called LLMjacking. Attackers take over a company’s access to large language models and run up charges on its cloud account.
Google said the attacks hit firms in North America, South America, and Asia Pacific. Victims worked in financial services, retail, technology, and transportation.
Charges Pile Up in Hours
Google compared LLMjacking to cryptojacking, where hackers quietly use stolen computing power to mine digital coins. Cryptojacking tends to drain resources slowly over time.
LLMjacking moves much faster. Google said some incidents produced more than $100,000 in fraudulent charges in a single day.
At some organizations, total charges reached $1 million before access was revoked. In one case, an attacker made more than 500,000 AI requests in under eight hours.
The most common way in was stolen or exposed cloud login tokens. These included service account keys, GitHub access tokens, and active session tokens.
One group, which Google tracks as UNC6993, broke in through a poorly configured service account key. It also built a fake portal that tricked users into pasting their access tokens, letting the group get past passwords and multifactor checks.
Other attackers pulled AI keys from public GitHub code. They tested each key with tiny one-token requests so security alerts would not fire.
Once inside, attackers created backdoor accounts and planted SSH keys. One group disguised its accounts as billing optimization tools. Another exploited a flaw in LiteLLM routing software, tracked as CVE-2026-40217, to gain full admin control.
Inside the Resale Market
Google said a split has formed between hackers who break in and those who sell the access. It calls the sellers “LLM Mixers,” which pool stolen keys and resell AI access to paying users.
UNC6993 used open-source tools such as new-api and gcli2api to combine stolen keys. Google believes the group sells access through underground storefronts and that it ran up more than $100,000 in charges at one victim.
One service, Jet Night, offers an unlimited plan for about $60 a month with claimed access to top models. Google said similar consumer plans usually cost between $100 and $250 a month.
Google linked Jet Night to the 500,000-call attack, which passed nearly $1 million in costs to the victim. The service has posted about outages on its Telegram channel, which Google said is likely because victims revoke the stolen keys.
A separate report last week from Broadcom’s Symantec and Carbon Black described a gray-market relay service. It installs the real OpenAI Codex and Anthropic Claude Code tools, then changes their settings to route requests through its own servers.
Symantec said the service has been active since at least early 2026 and hit about a dozen organizations, mostly in mainland China. It turns off the tools’ safety sandbox and swaps in its own access tokens, though Symantec found no evidence it altered responses or collected prompts.
Google said it expects criminals to favor LLMjacking over cryptojacking going forward. It urged companies to rotate keys, limit permissions, set budget caps, and treat any unexpected activation of AI services as a critical security event.
