Google Warns of LLMjacking Campaigns Generating $1 Million in Fraudulent Cloud AI Charges

According to a recent analysis, large language model hijacking attacks (LLMjacking) are generating significant fraudulent cloud charges, with cumulative losses surpassing $1 million. Some affected organizations report daily costs exceeding $100,000. The attacks involve unauthorized use of cloud AI resources to run compute-intensive large language model tasks beyond the intended scope of service usage. Google Cloud AI users are the primary targets, with threat actors likely gaining access to accounts or APIs to exploit hosted model resources for personal or commercial compute needs. Google has not released details on specific attack vectors, victim organizations, or the exact methodology used, but the company attributes the financial impact to account compromise and misconfigured access controls. The company recommends implementing strict IAM policies, rigorous API key management, monitoring for unusual API usage patterns, and enabling budget alerts to mitigate the risk. No software patch is available, as the issue is rooted in account and configuration security.