Google finds ‘LLMjacking’ attackers running up $100K a day in fraudulent cloud charges

What happened

Google’s Mandiant and Google Threat Intelligence Group uncovered a new attack method called LLMjacking. Attackers hijack enterprise-level access to large language models (LLMs) and run up fraudulent cloud usage charges exceeding $100,000 per day. The findings come from a report titled “The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources.” These criminals exploit stolen credentials or vulnerabilities to commandeer cloud resources linked to AI model access and force businesses to pay for large volumes of unauthorized model queries.

The risk

LLMjacking attacks create a direct financial threat by inflating cloud bills through unauthorized LLM usage. Beyond financial loss, enterprises face the risk of compromised data or degraded system performance as attackers consume computational resources. The attacks also lower trust in cloud-based AI services, pushing operators and security teams to rethink access controls around AI infrastructure. Since actual LLM workloads are expensive, the threat scales quickly, making it a high-impact cost and security issue.

Why it matters

As AI adoption deepens, cloud resources tied to LLMs become a prime target for attackers seeking quick profit. Enterprises relying on cloud-hosted AI models will now need to strengthen access management and monitoring to avoid surprise charges and resource hijacking. This raises the operational cost of running AI systems and increases pressure on cloud providers to detect and stop fraudulent usage. Security teams must work closely with IT and finance to spot unusual activity patterns linked with AI model calls before costs spiral out of control.

Who should pay attention

Tech operators, cloud service customers, cybersecurity teams, and CFOs managing cloud spend must take notice. Developers deploying LLM-powered apps should audit their access policies and monitor usage tightly. Investors and businesses evaluating AI infrastructure risk should factor these growing fraudulent costs and security challenges into their pricing and operational modeling. Cloud providers face the task of enhancing fraud detection to protect their customers and maintain trust.

What to watch next

Expect cloud vendors to roll out tools targeting fraudulent LLM usage detection and alerting. Improvements in AI model access authentication and usage accounting will be key. Watch for regulatory scrutiny around cloud fraud and AI service transparency. Enterprises that quickly implement robust controls may avoid costly overages and reputational damage, while laggards will pay higher bills and face elevated risk exposure. The evolving LLMjacking threat underscores the need for tighter AI security practices as adoption scales.

AI Quick Briefs Editorial Desk