Google Threat Intelligence Group (GTIG) and Mandiant documented several cases of LLMjacking in 2026 — the use of stolen cloud credentials to run large language models (LLMs) at a company’s expense — in which victims racked up charges of more than $100,000 in a single day and, at some organizations, up to a million dollars accumulated before access was cut off. The report, published on November 2, 2026, puts the spotlight on a problem that is no longer just a security issue: the AI bill can spiral in hours.
LLMjacking and the cloud bill in 20 seconds
- Google and Mandiant describe LLMjacking attacks against companies across several sectors in a report dated 11/02/2026.
- There were charges of more than $100,000 in a single day and up to a million dollars accumulated.
- The usage is billed to the organization whose credentials were used.
- AWS, Azure, and Google offer budgets and alerts, but not all of them cut off spending on their own.
Victims come from financial services, retail, technology, and transportation, with a presence in North America, South America, and Asia-Pacific. The technical mechanism (exposed keys, stolen session tokens, vulnerable gateways, and resale services) is explained in detail in OpenSecurity’s analysis of how access to AI models gets stolen and which logs to check. What matters here is the other side of the story: who pays, why the alerts arrive late, and what tools the big providers offer to put a ceiling on spending.
The phenomenon isn’t new, either. Sysdig coined the term in May 2024 and calculated that, in the worst-case scenario, with a Claude 2.x model pushed to its quota limit across several regions, the cost to a victim could top $46,000 a day. Microsoft, for its part, sued the members of Storm-2139 between December 2024 and February 2025, a network that broke into Azure OpenAI Service using customer credentials exposed in public sources and resold that access.
A Bill That Grows in Hours, Paid by the Account Holder
The difference with other forms of cloud abuse is speed. According to GTIG, while cryptojacking consumes resources gradually, LLMjacking can generate large spikes in charges within a matter of hours. The most striking case in the report is Jet Night, a resale service that ran more than 500,000 API calls in under eight hours and passed almost a million dollars in token costs on to a single organization. That same service sold unlimited access for about $60 a month. Google attributes those abnormally low prices to the fact that the access to the models is stolen.
In several incidents, the AI services weren’t even enabled: the attackers turned them on, accepted pay-as-you-go agreements for premium models, and requested additional GPU quota. For the finance department, that means an account with no AI project at all can wake up to an AI bill.
The cost is assumed, in principle, by the company that was attacked. Providers work under the shared responsibility model. AWS sums up its own responsibility as security “of” the cloud, while the customer is responsible for security “in” the cloud, which includes managing identities, permissions, and credentials. GTIG explicitly talks about costs “passed on to the victim organization,” and none of the sources consulted mention a general commitment to refund fraudulent usage. Any adjustment depends on the provider and the specific case, so a company has to plan as if the charge were its own.
What AWS, Azure, and Google Cloud Offer to Cap Spending
The three major providers have budgets and alerts, but they behave differently once a threshold is crossed. It’s worth knowing the fine print before relying on them as a brake.
| Provider | Tool | Does it cut off spending? |
|---|---|---|
| AWS | AWS Budgets with actions | Can apply an IAM deny policy, a service control policy (SCP), or act on EC2 and RDS instances, either automatically or after manual approval. |
| Microsoft Azure | Cost Management budgets | No. They only alert; action groups can trigger Azure Functions or webhooks that the customer has to set up. |
| Google Cloud | Cloud Billing budgets | Not on their own. They send notifications over Pub/Sub that a function can use to stop resources or disable billing. |
Microsoft spells this out in its own documentation. Once a threshold is crossed, according to its budgets tutorial, “resources aren’t affected, and consumption doesn’t stop.” On top of that, cost data is typically available 8 to 24 hours later, and budgets are evaluated every 24 hours. With an attack capable of generating $100,000 in a single day, the alert can arrive after the damage is already done.
Google suggests connecting budget notifications to a function that selectively shuts down resources, and warns of the radical alternative: disabling billing on a project stops every service and ends up deleting the resources. AWS is the only one of the three that builds blocking actions directly into the budget itself, although it too depends on delayed billing data.
That’s why GTIG insists on controls that act before the spending exists: API quotas and spending limits per model, API keys scoped by model, environment, and use, and explicit denial of the LLM services a company doesn’t need. In AWS Organizations, an SCP can restrict which models and regions can be invoked across every account.
FinOps and Security, at the Same Table
LLMjacking falls between two teams that often don’t talk to each other. Security watches credentials and logs; the cloud financial operations (FinOps) team watches the bill. AI spending was already forcing a rethink of FinOps practices, because controlling cloud cost is no longer just about spending less, and this kind of attack adds a security dimension on top.
The recommendations in Google’s report and in the providers’ own documentation add up to a practical checklist for any company that uses, or might use, models in the cloud:
- An inventory of AI services enabled in every account, subscription, and project, with an owner assigned. GTIG calls this discovering “Shadow LLM.”
- Default denial of unapproved models and regions, with documented exceptions.
- Per-project budgets with automatic actions where the platform allows it, and custom automation where it doesn’t.
- Per-model quotas that act as a technical ceiling, independent of billing.
- Centralized secrets management, automatic rotation, and phishing-resistant multi-factor authentication for anyone who can create keys.
There’s one last wrinkle. Revoking the stolen key doesn’t close the incident, because attackers create backup accounts, keys, and service accounts, some disguised as internal billing-optimization tools. The fact that an intruder can dress up their backdoor as a FinOps utility says a lot about why both teams need to review together which identities exist and who created them. Credential theft has long been attackers’ preferred route, as this outlet reported when credential abuse surpassed malware as the top silent threat. With pay-as-you-go AI, that risk shows up directly on the bill.
Frequently Asked Questions
Who pays the bill for an LLMjacking attack?
Usage is billed to the account whose credentials were used. Under the shared responsibility model, managing identities and credentials is the customer’s job, and the sources consulted don’t mention a general commitment to a refund.
How much can LLMjacking cost?
Google documented charges of more than $100,000 in a single day and up to a million dollars accumulated at some organizations. In 2024, Sysdig estimated a cost of more than $46,000 a day in its worst-case scenario.
Do Azure budgets stop spending?
No. Microsoft states that once the threshold is crossed, resources aren’t affected and consumption doesn’t stop. The response has to be programmed through action groups, for example via Azure Functions.
How can a company limit its cloud AI spending?
With per-model quotas, denial of unapproved services, budgets with automatic actions, and scoped API keys. Billing alerts help, but they arrive with a delay.
Sources:
- Google Threat Intelligence Group: The Rise of LLMJacking (11/02/2026)
- OpenSecurity: LLMjacking, how access to AI models gets stolen in the cloud
- Sysdig: LLMjacking (05/06/2024)
- Microsoft: Disrupting a global cybercrime network abusing generative AI (02/27/2025)
- AWS: Configuring budget actions
- AWS: Shared Responsibility Model
- Microsoft Learn: Create and manage budgets
- Google Cloud: Control resource usage with notifications
- elhacker.net
This article is also available in Spanish: “LLMjacking: cuando una clave robada convierte la IA en una factura de un millón”, on revistacloud.com.
