# LLMjacking: Google warns hackers are running up $100,000 AI cloud bills in minutes with stolen API keys

Source: Searchable (https://searchable.pk/news/ai/llmjacking-google-warns-hackers-are-running-up-dollar100000-ai-cloud-bills-in)
Type: News article
Author: Searchable Editorial
Published: 5 Nov 2026
Updated: 5 Nov 2026
Retrieved: 5 Nov 2026

> Google's Threat Intelligence Group says criminals steal cloud and AI credentials, switch on premium models and sell the access. Here is how it works and what Pakistani developers and startups should lock down today.

**LLMjacking**, the theft of AI accounts and cloud credentials to run expensive AI workloads on someone else's bill, can rack up **more than $100,000 (about Rs 2.77 crore) in charges within minutes**, Google's Threat Intelligence Group (GTIG) has warned, ARY News reported. For Pakistani freelancers, software houses and startups that build on paid AI APIs, a single leaked key is now a direct financial risk.

## How the attacks work

1. **Finding a way in.** Attackers look for exposed AI endpoints or steal API keys and cloud credentials: identity tokens, service account keys, **GitHub personal access tokens** and live session tokens.
2. **Digging in.** Once inside, they raise their privileges, keep access, and look for AI services they can use.
3. **Cashing out.** They run their own AI jobs, route requests through the hacked account, or **sell the access** to others.

Google says one group it tracks as **UNC6993** caused more than $100,000 in charges after stealing LLM API keys and switching on services in a victim's cloud project. In another case, attackers moved compromised accounts onto **pay-as-you-go plans**, picked premium models and ran large numbers of inference jobs, creating and deleting temporary service accounts to dodge rate limits while watching the victim's billing dashboard.

Unlike cryptojacking, where costs creep up slowly, LLMjacking does its damage almost immediately. Google says it is becoming a specialised trade, with some groups breaking in and others, called **"LLM Mixers"**, running gateways that pool stolen credentials and resell AI access underground.

## What to do if you use AI APIs

- **Never commit keys to GitHub**, public or private. Use environment variables or a secrets manager, and turn on secret scanning.
- **Set hard budget caps and billing alerts** on every cloud and AI account, so a spike stops at a limit you chose.
- **Give each key the least access it needs** and an expiry date. Delete keys you no longer use.
- **Watch for new service accounts** or model changes you did not make, and treat them as an incident.
- **Turn on two-factor login** for cloud consoles and code repositories.

A surprise bill in dollars hits harder at Rs 276.7 to the dollar ([dollar rate today](/data/usd-pkr)). If you earn in dollars as a freelancer, the [freelancer tax calculator](/tools/tax/freelancer-tax-calculator) shows what you keep.

## If you are hacked

Revoke every key at once, contact your cloud provider's support to dispute fraudulent charges, and report it to the NCCIA; our guide explains [how to file a cybercrime complaint online](/guides/government/cyber-crime-complaint-online).

## Frequently asked questions

**What is LLMjacking?**

LLMjacking is the theft of AI accounts, API keys or cloud credentials to run expensive AI workloads on the victim's bill, or to sell the access. Google says it can cost over $100,000 within minutes.

## Sources

- Google warns LLMjacking cyberattacks are costing cloud AI customers massive bills (5 Nov 2026) (ARY News): https://arynews.tv/google-warns-llmjacking-cyberattacks-are-costing-cloud-ai-customers-massive-bills

How to cite: "LLMjacking: Google warns hackers are running up $100,000 AI cloud bills in minutes with stolen API keys", Searchable, 5 Nov 2026, https://searchable.pk/news/ai/llmjacking-google-warns-hackers-are-running-up-dollar100000-ai-cloud-bills-in