Google has warned that threat actors are increasingly hijacking enterprise access to Large Language Models (LLMs) to abuse expensive compute and AI services at the victim’s expense. The technique, dubbed LLMjacking, adapts classic cloud resource hijacking tactics to the generative AI era.

According to Google, attackers obtain valid API keys through several common avenues, including phishing campaigns, leaked source code, misconfigured cloud environments, and exposed client-side code. Once an attacker has a working key, they can route their own workloads through the victim’s LLM access, consuming paid compute resources without authorization.

Why It’s So Costly

LLM inference is computationally expensive, especially for high-end models used for large-scale text generation, code completion, or multimodal tasks. Because enterprises are typically billed per token or per compute-hour, attackers can generate massive fraudulent charges in a short window before the abuse is detected. Google noted that some affected enterprises have seen cloud costs climb as high as $1 million as a direct result of this activity.

How Keys Get Exposed

  • Phishing: Credential theft campaigns targeting developers and cloud administrators
  • Source code leaks: API keys hardcoded into repositories, including public or improperly secured private repos
  • Misconfigured environments: Cloud storage, containers, or CI/CD pipelines left open or improperly permissioned
  • Exposed client-side code: Keys embedded in web or mobile application code that can be extracted by inspecting network traffic or decompiling binaries

Once stolen, keys can be resold or used directly by attackers to run their own AI workloads, from generating content at scale to powering other automated abuse, all billed back to the compromised enterprise’s account.

What Security Teams Should Do

Google’s warning underscores the need for organizations to treat LLM and AI service credentials with the same rigor applied to traditional cloud API keys. This includes rotating keys regularly, scanning repositories and client-side code for hardcoded secrets, enforcing least-privilege access, and monitoring usage patterns for anomalous spikes in token consumption or API calls that could indicate hijacking in progress.

As enterprises continue to integrate LLMs into production workflows, exposed credentials are becoming a direct financial liability, not just a security one.