AI security

Criminals are hijacking companies’ AI accounts and leaving them the bill, Google says

Published November 4, 2026

On November 2, Google’s Threat Intelligence Group published a report on “LLMJacking”: criminals breaking into companies’ cloud accounts, switching on paid AI models, and running them on the victim’s tab. Google says the fraudulent charges topped $100,000 in a single day in some cases and reached $1 million at some organizations before access was cut off. Some of that stolen access is then resold to other people as cheap “unlimited” AI plans.

What happened

Companies pay for AI by usage. Each request to a large language model (LLM), the kind of AI behind chatbots, is billed by the token, a small chunk of text. Access is controlled by an API key, a long password that lets software call the model directly. Whoever holds the key can spend the account owner’s money.

Google’s report, based on incidents its Mandiant team responded to in 2026, says the most common way in was stolen or exposed cloud login material: keys for service accounts (accounts used by software rather than people), GitHub access tokens, and active session tokens. One group harvested AI keys that companies had accidentally posted in public code on GitHub. It tested each key with a one-token request, small enough to slip past alarms that watch for unusual volume.

Once inside, attackers often switched on AI services, sometimes ones that were not enabled when they broke in, and created extra keys; one picked premium models. One group, which Google tracks as UNC6993, ran up more than $100,000 in charges this way. In another case, Google says, an attacker made more than 500,000 AI requests in under eight hours.

Google says those requests powered Jet Night, a service that sells AI access to the public. It cost the victim nearly $1 million. Jet Night advertises an unlimited plan for about $60 a month. Google estimates comparable legitimate service would run $100 to $250 a month, and believes that price only works on stolen keys. Google calls these resale services “LLM Mixers.”

Why it matters to a normal person

If you build anything with AI, even a weekend project, your API key is effectively a credit card number. Do not paste it into code you share, and set a spending cap with your provider. Google’s own advice to companies is the same idea at scale: give each key only the models it needs, set budgets and alerts, and automatically scan code for keys so any that slip in are found and removed quickly.

It is also a reason to be wary of AI deals that look too good. A cheap “unlimited frontier model” plan may be running on someone else’s stolen account, and, Google notes, Jet Night has posted multiple outages that are likely due to victims discovering the theft and revoking the keys.

There is a wider cost too. John Hultquist, chief analyst at Google Threat Intelligence Group, told The Register that locking down these accounts also protects everyone from “a deluge of cheap, autonomous attacks” run on stolen AI.

What it does not mean

It does not mean AI companies were hacked. Google describes customers’ own credentials being stolen or left exposed. The AI providers simply processed requests that looked legitimate and billed the account owner, as BleepingComputer explains.

Google’s report is about company cloud and AI accounts, not personal chatbot subscriptions. The incidents Google describes hit businesses in finance, retail, technology and transportation that pay per use through cloud platforms.

And it is not brand new. The Register notes LLMJacking has grown steadily for about two years, and points to an August CrowdStrike report of one thief sending about 200,000 requests in two minutes. What Google adds is detail on the resale market, and a forecast that criminals will increasingly prefer this to cryptojacking, the older trick of secretly using someone else’s computers to mine cryptocurrency. The figures here are Google’s, from its own investigations, and it has not said how many companies were affected.

Sources

The rise of LLMJacking: How threat actors monetize compromised cloud and model resources — Google Threat Intelligence Group (primary source; Nov 2, 2026)
Token thieves costing companies $100K+ per day in illicit LLM charges — The Register, Jessica Lyons (Nov 2, 2026)
Google: LLMjacking attacks rack up $1 million in cloud AI charges — BleepingComputer, Bill Toulas (Nov 3, 2026)