LLMjacking: How a Single Leaked API Key Can Result in a Million-Dollar AI Bill

One leaked key in a repository, and within a few hours, a cloud bill for hundreds of thousands of dollars arrives. Security analysts warn that theft of access to language models has become a separate and well-organized business.

What is LLMjacking?

In LLMjacking, attackers don’t hack the chatbot that the user sees. They go straight to its source: the models running in the cloud. They search for publicly accessible model endpoints or attempt to obtain valid API keys and cloud credentials that allow them to use the models on the victim’s behalf.

This is similar to older “cryptojacking” attacks, where attackers exploited other people’s computing power to mine cryptocurrencies. The difference lies in speed and cost. Calls to large models are expensive, and if an account has high limits, costs can skyrocket within minutes.

Figures from the latest analysis

Researchers from Google’s Threat Analysis Team and Mandiant published a report on these attacks in early November 2026. According to the report, the stolen credentials resulted in fraudulent cloud charges for the victims totaling approximately one million dollars. In one of the cases described, the attacker made more than 500,000 model calls in less than eight hours. For another group, the charges exceeded $100,000 shortly after the keys were obtained, and analysts estimate charges in the range of $100,000 per day.

According to the organization’s researchers, the attack affected multiple regions and industries, including finance, retail, technology companies, and transportation.

How attackers gain access

The most common method isn’t a sophisticated exploit, but a stolen or compromised cloud identity. Examples include:

• Login credentials for administrators and service accounts,
• service account keys,
• personal access tokens to code management services,
• active session tokens,
• API keys that were accidentally exposed in public repositories.

Attackers then often send just one small request to verify that the key works. Such “test” calls with a single token are one of the few early warning signs. If they gain access, they generate additional keys and enable related services directly within the victim’s project, thereby expanding their capabilities.

How Stolen Labor Is Monetized

Interestingly, the attackers usually do not use the keys themselves. They collect them through gateways that aggregate many stolen keys, distribute the load, and measure the consumption of paying subscribers. Researchers call them “LLM Mixers.” The access is then resold on the dark web; according to available information, for as little as tens of dollars a month. A customer at such a store has inexpensive access to powerful models, and someone else entirely pays the bill.

This explains why victims’ bills balloon so quickly: the stolen key isn’t used for a single attack, but as a source for dozens or hundreds of paying users.

Why this also applies to small businesses and developers

Slovak teams that tested AI in a pilot project often work with a single key without restrictions, which no one monitors. Such a key is exactly what attackers are looking for. Typical mistakes include:

• A key hard-coded in the source code or in a configuration file that ends up in a public repository,
• a single key with unlimited permissions for all environments,
• no spending limit at the model or project level,
• disabled or unmonitored cloud logs,
• long-term tokens that are never rotated.

Also be aware that older keys created for a completely different purpose may suddenly gain access to AI once a new service is enabled in the same project. Yet no one remembers such a key, and no one is looking for it.

How to Protect Yourself: A Practical Checklist

• Restrict keys. Each key should only have access to the models and services it actually needs, and separate environments (development, test, production) should not share keys.
• Set quotas and spending limits for individual models. A budget-exceeded alert won’t stop an attack on its own—it merely notifies you—so it’s better to also have a hard limit where the service allows it.
• Scan repositories for leaked keys, including change history, and immediately rotate anything that has ever appeared in public code.
• Apply the principle of least privilege and strong authentication for administrators and service accounts.
• Enable and monitor logs, including model call logs. Issue alerts for the activation of unknown AI services, unusually small test requests, and any attempts to disable logging.
• Regularly audit which AI services and models are enabled in the cloud environment, and disable anything you do not recognize.

If this has already happened

If you notice a suspicious increase in costs, immediately revoke the affected keys and tokens, disable unknown services, and back up your logs before taking any further action. Then contact your cloud provider and request an investigation into the charges. Keep in mind, however, that refunds are not automatic and the decision depends on the circumstances; therefore, prevention is much cheaper than dealing with the consequences.

Summary

LLMjacking turns an API key into a currency. For attackers, it’s a cheap and quick way to make money; for victims, it’s a problem that only becomes apparent when the bill arrives. For small teams, this leads to a simple rule: treat your AI key like a bank account password—restrict access to it, monitor it, and never leave it in the code.