Token Thieves Costing Companies $100K+ per Day in Illicit LLM Charges

Enterprises pay $100,000 a day for AI they never ordered

Enterprises deploying large language models (LLMs) in production may be unknowingly footing the bill for someone else’s AI business. Google Threat Intelligence Group (GTIG) is warning of financially motivated LLMjacking campaigns in which cybercriminals hijack enterprise cloud and model access before reselling it through underground subscription services. The activity can generate fake cloud charges exceeding $100,000 in a single day, GTIG said …

Token thieves costing companies $100K+ per day in illicit LLM charges

Don't let the LLMjackers hit you

Stolen AI access leaves companies with cloud bills of up to $1 million

Criminals who break into corporate cloud accounts are using the stolen access to run AI models at the victim’s expense, in some cases racking up more than $100,000 in charges in a single day, Google Threat Intelligence Group (GTIG) and Mandiant researchers have found. Usage chart showing LLMJacking generating a spike in API requests (Source: Google) In 2026, Mandiant responded to several of these LLMJacking incidents, recorded in attacks on the …

Google finds 'LLMjacking' attackers running up $100K a day in fraudulent cloud charges

A new report out today from Google LLC’s Mandiant and Google Threat Intelligence Group finds that attackers who hijack enterprise access to large language models are running up fraudulent cloud charges of more than $100,000 in a single day. The report, “The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources,” covers […] The post Google finds ‘LLMjacking’ attackers running up $100K a day in fraudulent cloud charg…