Google warns of LLMjacking attacks driving up cloud bills

Hackers are increasingly stealing access to companies’ large language model (LLM) services, using them to run up cloud bills, according to a report from Google’s Threat Intelligence Group (GTIG). The practice, known as LLMjacking, involves hijacking foundation-model resources through token proxying, automated model streaming or GPU provisioning.

Attackers often begin with publicly exposed LLM endpoints or stolen API keys. They may use cloud identity credentials, GitHub Personal Access Tokens or active session tokens to enter an organization’s infrastructure, then raise their privileges and expand access.

The financial impact can build quickly. Google said one group, UNC6993, generated additional API keys and enabled services in victim cloud projects, accumulating more than $100,000 in charges. In another described method, an attacker subscribed victim accounts to pay-as-you-go plans for premium models and sent high volumes of requests. The attacker repeatedly created and deleted short-lived service accounts to bypass rate limits while tracking the charges.

Some attackers also resell unauthorized access through intermediaries Google calls “LLM Mixers,” which route and aggregate requests for underground subscribers. GTIG said it observed two operational clusters coordinating to compromise and monetize enterprise LLM infrastructure.

Google expects attackers to increasingly target LLM resources. It recommends organizations monitor LLM accounts and services for unauthorized changes, treat unauthorized enablement as a critical security event, and limit account permissions to what users need.