Google Threat Intelligence Group (GTIG) and Mandiant published a report on LLMjacking, the hijacking of organizations' access to language models. Attackers obtain an API key or cloud credential, through phishing, leaked source code, misconfigurations or exposed client-side code, and use the models while the organization pays. According to the report, unlike cryptojacking, which consumes resources gradually, the charges can spike within hours: more than $100,000 in a single day, and up to $1 million in total at some organizations before access was revoked.
The most common entry point is exposed or stolen cloud identity tokens, such as service account keys, GitHub personal access tokens and session tokens. Once inside, the attackers search code and repositories for more secrets, create new service accounts and keys to keep their foothold, and in some cases exploit flaws in model-routing software such as LiteLLM. According to Google, a layer of "LLM Mixers" has also emerged that resells stolen model access to other criminals.
Affected organizations are in North America, South America and Asia-Pacific, in financial services, retail, technology and transportation. What to do: keep API keys out of code and public repositories, limit service account permissions, rotate keys that may have been exposed, and set alerts for sudden spikes in cloud AI service charges.