LLMjacking is an attack in which criminals use stolen enterprise credentials to consume AI model services at the organization's expense, sometimes reselling that access to others. For executives, the implication is straightforward: an exposed API key is not just a security incident. It can become an open-ended financial liability that keeps growing while business systems appear to be running normally.
According to Google's Threat Intelligence Group, or GTIG, these attacks can generate charges exceeding $100,000 a day. The lesson for enterprises is not to slow AI adoption. It is to stop treating model access as a technical detail that gets configured once during deployment.
- More than $100,000 in potential daily charges, according to GTIG.
- More than 500,000 requests in less than eight hours in one reported incident.
- Nearly $1 million in costs to the affected organization in that incident.
These figures come from incidents described in the analysis. They are neither an average cost per attack nor a forecast for every enterprise. They do, however, illustrate the gap between how quickly charges can accumulate and how slowly conventional controls operate. Reviewing a monthly invoice is not an adequate defense.
They Are Not Stealing the Model. They Are Stealing the Right to Bill You
An LLMjacking attacker does not need to copy model weights or compromise an AI provider's infrastructure. Access that allows paid requests is enough. A key left in a public code repository, an overprivileged service account, or a stolen cloud token can open the door.
According to GTIG, some attackers aggregate stolen keys in routing gateways known as LLM Mixers. These gateways distribute requests across different accounts, allowing attackers to sell subscribers access funded by the victims. In one reported incident, a service called Jet Night made more than half a million requests in less than eight hours, costing the affected organization nearly $1 million.
That is why a service offering generous model access at an unusually low price warrants due diligence. A low price is not proof of criminal activity. But an enterprise cannot stop at confirming that the service works. It needs to understand who the provider is, what authorizes it to supply access, and what terms govern usage and data handling.
During this attack, systems can remain available, employees can keep working, and financial damage can accumulate in the background. No outage does not mean no incident.
The First Warning May Be a Tiny Request
One important finding in GTIG's analysis is that attackers sometimes test keys with tiny, single-token requests. This confirms that access works without immediately producing a conspicuous consumption spike.
Monitoring spending alone therefore misses part of the picture. Enterprises need to connect identity, permissions, behavior, and budget: who called the model, from which environment, whether this was the identity's first activity, and whether a key was created or permissions changed beforehand.
This does not make every small request suspicious. It means a sequence of events matters more than a single threshold. A new identity that receives broad permissions and immediately tests model access deserves investigation even when the charge is negligible.
- Budget alerts: Detect rising spending but can miss tiny access tests.
- Identity monitoring: Detects unusual permissions and changes but can miss accumulating costs.
- Usage monitoring: Detects abnormal consumption patterns but can miss the origin of the stolen access.
- Combined controls: Connect identity, usage, and cost, but require business context.
The point is not to choose one control. Protection comes from connecting them, with a designated owner authorized to act when the combined evidence indicates abuse.
A Budget Alert Is Not a Spending Cap
This distinction belongs in every executive discussion about AI costs: an alert tells you something has happened; an enforceable limit constrains what can happen next. In some services, setting a budget does not automatically stop consumption. Check how the mechanism behaves at both the provider and routing layers. Do not assume a setting blocks charges simply because it is called a budget.
Check what actually stops: Do not assume a budget alert blocks usage. Verify which quotas are enforced, how long reporting takes, and what happens to requests already submitted.
A hard limit is not a complete solution either. A blanket shutdown could interrupt a critical service or operational process. Separate development from production, distinct business workflows from one another, and individual agent identities. That makes it possible to contain a specific incident without stopping every AI workload in the enterprise.
A useful management metric is potential exposure before containment: how much consumption can occur before detection, a response decision, and actual access revocation. That calculation depends on your architecture. It is not a fixed property of the model provider.
Agent Infrastructure Must Include the Ability to Stop Agents
Enterprises need internal capabilities to build and manage AI agents. But a platform that only connects a model, adds tools, and deploys a workflow is not a complete enterprise foundation.
It also needs identity lifecycle management, secrets management, permission separation, usage logging, cost attribution, and targeted revocation. A key issued to one application should not grant unrestricted access to other models and services.
A central routing gateway is not automatically a security layer, either. It can improve control, but it also concentrates access privileges and therefore requires hardening, updates, and separation between administration and usage. GTIG also described exploitation of a vulnerability in the LiteLLM gateway that enabled privilege escalation. The lesson is not to avoid gateways. It is to manage them as sensitive infrastructure.
An Action Plan That Connects Security, Finance, and Operations
The starting point is not another product purchase. It is clear accountability. Who knows which identities consume model services? Who receives the alerts? Who can disable access overnight without waiting for an executive meeting?
- Map access: Inventory providers, routing gateways, keys, and service identities, assigning a business owner and a technical owner to each.
- Reduce permissions: Separate workflows and environments, store secrets in a dedicated system, and prefer short-lived identities where possible.
- Connect monitoring and costs: Correlate permission changes with model activity and spending to detect abuse even when it starts small.
- Define and rehearse containment: Run a controlled exercise to verify that suspicious access can be revoked, the impact understood, and a critical workflow restored.
This requires shared responsibility. Security owns detection and response. IT owns infrastructure and identities. Finance owns exposure and cost attribution. Business teams define normal activity and the consequences of interruption. An external partner can help, but organizational accountability cannot be outsourced.
A Human in the Loop, Not a Human Approving Every Request
The answer is not to add manual approval to every model call. That would erase the efficiency AI was introduced to deliver. The goal is to let people oversee many processes through enforceable policies, operational visibility, and escalation of meaningful exceptions.
Literacy matters too. Employees and developers need to understand why an API key should never be pasted into a chat, shared file, or code repository. Training and infrastructure reinforce each other. Neither replaces the other.
This is also a test for selecting an implementation partner. A convincing agent demonstration is not enough. You need deep professional expertise, relevant education, and business and implementation experience sufficient to design for failure as well as success. AI is not just a technical concern, and the cloud bill is not just a finance concern. An enterprise that wants to scale AI confidently must know not only what its agents do, but who can invoke them, who pays, and how unauthorized usage can be stopped.