Google warns criminals are hijacking companies' cloud AI, leaving bills of up to $1 million
Attackers are taking over companies' access to cloud AI services and reselling it, and the charges land on the victims. A firm can be billed even on a cloud account where it never switched AI on.
Good Transformer is Patrick Hussey's AI practice. Want help with this in your business? Get in touch.
On 2 November, Google's threat intelligence team reported that criminals are breaking into companies' cloud accounts to use the AI services inside them. In some of the incidents it investigated, fraudulent charges passed $100,000 in a single day, and at some organisations the total reached $1 million before the access was shut off.
The report comes from the Google Threat Intelligence Group and Mandiant, Google's team that investigates break-ins for clients. Mandiant says it responded to several of these incidents this year, at organisations in financial services, retail, technology and transportation. In one incident, attackers made more than 500,000 requests to AI services in under eight hours.
The security industry calls this LLMjacking. Google names the victims' sectors, not their size, but the method works on any organisation that pays for AI by use, or that has a cloud account where AI can be switched on. That includes many small firms that would not think of themselves as AI users.
What LLMjacking is
An LLM, or large language model, is the kind of AI behind ChatGPT, Claude and Gemini. People use these through an app. Software uses them through an API, a connection that lets one program send requests to another.
Every request through an API is charged to an account. Two kinds of key give access to that account, and both work like passwords. An API key lets a piece of software use one AI service. A cloud login key lets software or staff sign in to a whole cloud account, such as a Google Cloud or Amazon Web Services account, and use whatever is inside it, including AI. LLMjacking means stealing either kind of key and using the AI at the account owner's expense.
Billing by use is different from the per-person subscriptions most firms start with, such as ChatGPT Business or Microsoft 365 Copilot licences, which cost a fixed amount per user each month. The risk in Google's report is in accounts billed by use, where there is no ceiling on what a month can cost unless someone sets one.
How the attackers get in
The report says the most common way in is "exposed or stolen cloud identity tokens": stolen cloud login keys, including keys that developers and their tools use to reach the account. Attackers also collect AI keys that have been left in code published on GitHub, the site where developers store and share code. And they look for AI programs that a company has installed on its own server and left open to the internet.
One group used a fake page to collect something else. When you sign in to a website, your browser keeps a session: a stored token that proves you are already signed in, so the site does not ask for your password again. The fake page persuaded people to copy that session token and paste it in. With it, the attackers could act as the signed-in person without knowing the password and without the second login step, such as a code sent to a phone.
In several incidents, the report says, the AI services "were not enabled at the time of compromise". Those organisations had not switched AI on in the cloud accounts concerned. The attackers used stolen cloud login keys to switch it on, and the charges began. So a firm with a Google Cloud, Amazon Web Services or Microsoft Azure account for some other purpose can be charged for AI that only the attackers used.
Why the attackers do it
They sell the access on. Google describes services it calls "LLM Mixers", which pool stolen keys and resell AI use to paying subscribers. One such service offered unlimited AI use for about $60 a month, while the report puts the usual price of comparable plans at $100 to $250 a month. The reseller can undercut the normal price because the victim pays for the AI its customers use.
Google expects this to grow. Its report says attackers "will increasingly prioritize LLMJacking" over cryptojacking, the older practice of using stolen computing power to produce cryptocurrency. Google puts the shift down to the quick profits the resale services make possible. The two also differ in speed: cryptojacking runs up costs gradually, while LLMjacking, Google says, "can generate large spikes in fraudulent cloud charges in a matter of hours". The spikes are that sharp because, the report notes, the attackers chose premium models, the most expensive to run, and sent requests at high volume.
What the report proves, and what it does not
Google has its own reasons to publish. It sells security services, including Mandiant's investigations, and some of the report's advice names Google's own products, such as detection rules for its security software. The core advice does not depend on buying anything: limit what each key can do, cap spending, scan code for keys left in it, and use strong login protection. It applies on all three big cloud platforms, and the report lists AI services on each of them, Amazon's Bedrock, Google's Gemini and Microsoft's Azure AI, among the targets.
The report is based on cases Mandiant handled itself, with named groups and the attackers' methods set out in detail. It shows that the attacks happen and that the bills can be very large.
It does not say how often this happens to small firms. The victims are described by sector, not size, and we have found no figure for small firms. Nothing in the method depends on size, though: a key left in the wrong place can be used by whoever finds it.
Who pays, and why an alert is not enough
The charges land on the victim's account. In one case the report describes, a service reselling stolen access "passed nearly one million dollars in token costs to the victim organization". Tokens are the small chunks of text AI services measure and charge by. We have found no published policy from any of the big providers that promises to refund charges caused by a stolen key, so a firm should not count on one.
A budget alert can look like protection, but it is weaker than it sounds. Google's documentation says that setting an alerts-only budget "doesn't automatically cap" spending. Amazon's says there can be a delay between a charge and the alert, and that "you might incur additional costs or usage" beyond the threshold before you are told. If charges can pass $100,000 in a day, an email that arrives hours later has not protected anything.
A hard spending limit is different: it stops requests once spending reaches the limit. The AI companies that sell direct to customers offer hard limits. OpenAI's documentation says an alert "sends a notification; API traffic continues", while a hard limit stops traffic, and hard limits can be set for a whole organisation or a single project. OpenAI adds that enforcement is not instant, so the bill can run slightly over. Anthropic gives most accounts a monthly cap set by its usage tier, and lets the owner "set your own spend limit below your tier's cap".
The big cloud platforms, where the attacks in the report took place, offer less. Google Cloud supports a spend-cap budget that pauses a service when costs pass the amount set, but only for some services. Amazon's budgets can trigger an automatic action when a threshold is reached, such as applying a policy that stops new resources being created, but Amazon updates budget information only up to three times a day, so the action can come late. On these platforms the stronger protection is to stop the AI being switched on at all where nobody needs it, and to limit who and what can switch it on.
What this means for your firm
Paying per person for ChatGPT or Copilot does not, on its own, carry this risk. The exposure comes from three other places, and a firm can have any of them without its leaders knowing.
- Someone built a tool. A developer or IT supplier has connected a small tool, such as a document summariser or a chatbot on your website, to an AI service. That tool runs on an API key, and the bill comes to you.
- Someone opened an account to try something. A member of staff signed up for a pay-as-you-go AI account on the firm's card, to test a tool, and the account is still open.
- The firm has a cloud account for something else. If you have a Google Cloud, Amazon Web Services or Azure account, for a website, files or an app, attackers with a stolen cloud login key can switch AI services on inside it, as the report describes.
Here is how the first of these can go wrong. A 20-person accountancy firm pays a developer to build a tool that drafts first replies to client emails, using an AI service billed by use. The tool costs a few pounds a day to run. Its key sits in the tool's settings on the developer's server, and in a copy of the code on the developer's laptop. If that key leaks, anyone who finds it can use the firm's account, at a rate the firm would never reach itself, until someone notices or a limit stops it.
A strange AI bill can also be a sign of something wider. The report describes attackers searching the accounts they reach for other passwords, and creating hidden service accounts, the kind software uses to sign in, disguised as internal "billing optimization" tools so that they look routine. A firm that sees an unexplained spike should check for that kind of change, not only cancel the key.
What to do this month
- List every account the firm pays for by use. Include AI services and the big cloud platforms. For each, write down who opened it, whose card pays for it and what it is for. Check card statements for charges from AI or cloud companies that nobody has mentioned. If nobody can explain an account, do not close it straight away: ask your IT support to find out what runs on it, and change its keys, before deciding.
- Put a hard spending limit on every AI account that offers one. Set it near what the firm really uses in a month, not at the provider's maximum. Keep the alerts too, but do not rely on them.
- Ask whoever built your AI tools three questions. Where are our keys stored? Who can see them? Are any of them written into the software itself, or into shared documents or chat messages?
- Stop AI being switched on where nobody needs it. Ask your IT support to make sure AI services are not enabled on cloud accounts that do not use them, to limit who can enable them, and to send an alert if one is switched on. The report says any "unauthorized enablement" should be treated "as a critical security event".
- Protect the logins to cloud and developer accounts. The report recommends "phishing-resistant multi-factor authentication": a second login step a fake page cannot capture, such as a passkey or a physical security key. That stops a stolen password, or a code typed into a fake sign-in page, from being enough to get in. It does not help once someone hands over a session token from a browser that is already signed in, so also tell staff never to copy anything out of their browser's settings into a page or a message, whoever asks.
- Give each tool its own key, limited to what it needs. With one shared key, a single leak exposes everything, and you cannot tell which tool caused a spike. A separate key per tool, with its own limit, keeps any damage small and easy to trace. The report also advises restricting each key so that a stolen one "cannot be used to invoke expensive, high-tier frontier models", so ask your developer to set each key to work only with the model its tool uses.
- Agree who acts if the bill spikes. Name the person who will cancel the key, check the account for new users and keys, and call the provider. Write their name down now.
Deciding which AI accounts the firm should have, who owns each one and what each may cost is part of the policy work in our AI Strategy engagement, two to three weeks with your leadership team.
If you want to talk through how to keep your firm's AI accounts under control, get in touch.
Common questions
What is LLMjacking?
LLMjacking is the theft of an organisation's access to a cloud AI service, usually through a stolen API key or cloud login key, so that criminals can use the AI or resell it while the organisation is charged.
Does a ChatGPT Business or Copilot subscription carry this risk?
Not in the way Google's report describes, because those plans charge a fixed price per user. The risk comes from accounts billed by use, including cloud accounts where AI can be switched on. A firm with a per-person subscription can still have one of those elsewhere, so it is worth checking.
Is a budget alert enough?
No. An alert tells you once spending passes a threshold, and it can arrive hours after the charges. A hard spending limit stops requests once the limit is reached. Use both where the provider offers them, and where it only offers alerts, stop AI being switched on where nobody needs it.
What should we do if our AI bill suddenly jumps?
Treat it as a security incident. Cancel the key in use, check the account for new users or keys you did not create, change the other keys and the passwords for that account, and contact the provider. Then work out how the key got out before you issue a new one.
Sources
- Google Threat Intelligence Group and Mandiant, The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources, 2 November 2026
- Google Cloud Billing documentation, budgets and budget alerts
- Amazon Web Services, Managing your costs with AWS Budgets
- OpenAI, Spend limits
- Anthropic, Rate limits
Work with Patrick
Want a clear AI plan for your business?
AI Strategy is two to three weeks with your leadership team: a 90-day plan, the use cases worth doing and a plain-English policy. Email, call or book a free 30-minute call.