Google Threat Intelligence Group (GTIG) and Mandiant have warned of the growing phenomenon of Large Language Model hijacking attacks, known as LLMjacking, which have resulted in organizations incurring heavy financial losses reaching up to one million US dollars in some cases due to fraudulent cloud consumption bills.
How the Attacks Work
Attackers rely on two main strategies to access AI infrastructure: the first is actively scanning publicly exposed endpoints, and the second is stealing valid API keys from unprotected devices. After gaining access, these resources are sold through intermediary services known as "LLM Mixers," which grant subscribers unauthorized access to artificial intelligence models.
Once access is resold, target systems experience a massive surge in request volume, potentially exceeding 1,000 requests per second, leading these requests to be logged as legitimate consumption and saddling the victim organization with exorbitant costs.
Evolution of Threats
Researchers have tracked threat groups such as UNC6993, which uses gateway tools to aggregate stolen keys and distribute requests. The exploitation of vulnerability CVE-2026-40217 in the LiteLLM platform has also been observed, allowing remote code execution on the server. In some cases, attackers used the victim's infrastructure to host agents and reverse proxies to provide unauthorized AI services under pseudonyms.
What Companies Must Do
Google emphasizes the necessity of taking proactive steps to secure operating environments, including:
- Identity and Access Management (IAM): Implement the principle of least privilege, preventing all unnecessary permissions, especially access to cloud AI services.
- Secrets Management: Use centralized platforms to periodically manage and rotate API keys and sensitive data.
- Monitoring and Control: Enable phishing-resistant multi-factor authentication (MFA) and set strict spending and consumption limits on APIs.
- Continuous Auditing: Monitor inference logs to detect any unusual activity or attempts to disable security logging.