Google reports enterprise LLM hijacking incidents with charges above $100,000 in a day

Mandiant responded to multiple LLMjacking incidents in 2026, according to Google.[1] The affected organizations were in North America, South America and Asia Pacific, and operated in financial services, retail, technology and transportation.[1] Google says fraudulent charges associated with resource consumption exceeded $100,000 in a single day.[1] At some organizations, cumulative charges reached $1 million before access was revoked.[1] For teams responsible for cloud budgets, these figures make it important to consider unauthorized model use as a potential source of abrupt spending, not just a gradual increase.

Google defines LLMjacking as attackers hijacking an enterprise’s access to large language models.[1] Attackers target exposed LLM endpoints or obtain valid LLM API keys, according to the company.[1] In its investigations, Google says the most common initial access method involved exposed or stolen cloud identity tokens.[1] The listed credentials included IAM credentials, service account keys, GitHub personal access tokens and active session tokens.[1] Security reviews can therefore include both model-specific access and the cloud identities or developer tokens that may provide a route to that access.

Google says LLMjacking can cause large spikes in fraudulent cloud charges within hours.[1] It contrasts that pattern with cryptojacking, where resource consumption is more gradual.[1] The difference matters for monitoring: a review focused on slow, sustained increases may not be enough to identify a rapid burst of unauthorized model use. Google also says it is tracking a division of labor between actors who establish initial access and operators who manage downstream monetization infrastructure.[1] In one investigation, it observed two operational clusters coordinating to compromise and monetize enterprise LLM infrastructure.[1]

Google describes LLM Mixers as illicit gateways that proxy, aggregate and resell unauthorized LLM access to underground subscribers.[1] It also says a threat actor can verify exposure by calling `/api/create` to run its own models.[1] In a mid-2026 incident, UNC6993 compromised a cloud instance through a misconfigured service account key, according to Google.[1] SiliconANGLE reports that visitors to a fake portal were directed to the real LLM service and asked to paste back a JSON payload containing an active access token.[2] It says the collected token let attackers bypass passwords and multifactor authentication.[2] In a separate method, another attacker scraped API keys from public GitHub repositories and tested them with requests capped at one output token.[2]