Attackers who hijack corporate access to large language models can generate more than $100,000 in fraudulent resource charges in a day and push cumulative bills at a victim close to $1 million before access is cut off, according to incident findings published by Google's Mandiant and Threat Intelligence teams.

Google calls the activity "LLMJacking." The investigations covered multiple incidents during 2026 and affected organizations in financial services, retail, technology and transportation across the Americas and Asia-Pacific. Unlike cryptojacking, which may consume computing resources gradually, unauthorized model use can create a sharp surge in API requests and cloud costs within hours.

The researchers described a developing criminal market around stolen AI access. Some groups obtain the initial foothold, while other operators manage infrastructure that aggregates and resells access. Google refers to those routing services as "LLM Mixers." In one investigation, two separate operational clusters coordinated to compromise an environment and monetize its model resources, evidence of increasing specialization.

The dominant entry route across the cases was not limited to model API keys. Attackers also used compromised identity and access-management credentials, service-account keys, GitHub personal access tokens and active session tokens. One group exploited a misconfigured service-account key, then granted itself access to an LLM API. It also used a fake application portal to persuade users to paste an active access-token payload, bypassing password and multifactor protections.

Other intrusions combined stolen repository credentials with a suspected application vulnerability, or abused cloud federation tokens to create fresh access keys. Google also observed attackers harvesting exposed corporate model keys from public GitHub repositories. To test whether those keys worked without creating conspicuous traffic, the attackers sent automated requests limited to a single output token.

After entry, the groups searched repositories, data stores, logs and cloud services for more credentials. In one compromised container environment, an attacker cloned sensitive code repositories and examined configuration data and logs. Elsewhere, attackers queried warehouse metadata for administrator passwords and other valuable fields. Abused token-creation permissions then allowed temporary credentials for more privileged service accounts, supporting further theft from cloud secret managers.

The findings show why model access must be treated as part of the wider cloud identity boundary. Protecting only a chatbot's front end does not prevent direct use of backend endpoints. Organizations need to remove exposed keys, narrow service-account permissions, monitor unusual model consumption and investigate abrupt cost changes quickly. Google presents the reported charges as observed incident figures, not a universal estimate, but the cases demonstrate how rapidly compromised AI infrastructure can become a major financial loss.