Google ties LLMjacking wave to resold API keys and $1 million cloud bills

Google's Threat Intelligence Group and Mandiant have published observations on LLMjacking, where stolen or exposed credentials are used to run someone else's LLM bill up. In the incidents they analysed, fraudulent charges passed $100,000 in a single day at some organizations, and cumulative charges at some reached $1,000,000.

The researchers describe two clusters working together: one scans for publicly exposed LLM endpoints, the other lifts valid API keys off unprotected machines. Access is then sold to "LLM mixers", which relay subscribers' prompts through the stolen keys. The provider bills the victim for tokens as ordinary consumption. Request volumes can jump past 1,000 per second once access is resold.

Google names Jet Night, which sells "unlimited access plans" for $60/month, and newapi[.]pro as examples of relaying infrastructure. It says one actor made more than 500,000 LLM API calls in under eight hours using stolen third-party keys to power jet-night.com, and that Jet Night passed nearly one million dollars in token costs to the victim. A separate cluster, UNC6993, aggregates stolen keys through gateway tools and likely sells access on underground forums.

Entry points listed include exposed or compromised cloud credentials, service account keys, GitHub tokens, active session tokens and LLM API keys. Attackers hunt for secrets, logs and secret managers, and try to leave backdoor accounts or SSH keys behind. Google also says it saw exploitation of CVE-2026-40217, a LiteLLM flaw that allows arbitrary code execution via the custom-code guardrail testing endpoint. In some cases victims' cloud infrastructure was used to host proxy endpoints and agentic workloads.

Google's advice starts with IAM: centralized secrets platforms with rotation, no standing privileges beyond the role, and denying permissions that aren't explicitly required, cloud LLM access included. Phishing-resistant MFA, visibility into shadow AI, API usage and spending caps, and monitored cloud audit and inference logs round it out.

The report doesn't say how many organizations were hit or over what period. We'd treat the spending caps as the cheap control here: a bill that spikes to six figures overnight is the detection signal most teams will actually see.

CVE references

CVE-2026-40217