Google Warns LLMjacking Attacks Are Costing Some Enterprises Up to $1 Million in Cloud Charges

A security flaw has come to light in Google, with enough detail now public for defenders to act on it.

The affected service is reachable from the network without authentication.

Google may already be doing an ordinary job in your environment while also being reachable from a network an attacker can access.

Google on Monday warned that threat actors are hijacking enterprise access to Large Language Models (LLMs) to fraudulently leverage expensive computing resources and AI services.

Google Threat Intelligence Group and Mandiant said in a report shared with DKCISSP.

The most common initial access vector has been exposed or stolen cloud identity tokens, including IAM credentials, Service Account keys, GitHub Personal Access Tokens (PATs), and active session tokens, which allow an attacker to establish an initial foothold into target organizations' infrastructure.

Anyone running Google 2.4.1 is exposed, and because this is reachable without authentication, exposure doesn't depend on a user doing anything.

The tactic is called LLMjacking , a form of resource hijacking adapted for the LLM era, where an attacker obtains an API key through phishing, source code leaks, misconfigured environments, or exposed client-side code to gain unauthorized access to an organization's LLM accounts, while the legitimate owner covers the consumption costs.

Such attacks have a wide geographical footprint, with impacted entities located in North America, South America, and Asia Pacific across the financial services, retail, technology, and transportation sectors.

What an attacker actually gains: successful exploitation allows the attacker to execute code with the permissions of the affected process.

This is the kind of exposure that gets found fast: no login needed, reachable from anywhere, and attackers scan for exactly this signature within hours of disclosure.

LLMjacking is on the other end, as they target the backend model resources directly by identifying publicly exposed LLM endpoints or obtaining valid LLM API keys.

The affected versions are 2.4.1, so that's the range to check against your own deployment.

This includes a threat actor called UNC6993, which is said to have breached a cloud instance through a misconfigured Service Account key and used it to obtain access to an LLM API.

In another case, an unknown attacker has been observed leveraging a stolen Personal Access Token to access private code repositories, following it up with the exploitation of a suspected web application vulnerability in a package running within a containerized cloud environment.

Some threat actors attempt to bypass rate limits by adopting a burn and rotate strategy that involves continuously creating and deleting short-lived service accounts The maturation of the LLMjacking ecosystem has also paved the way for the emergence of a new category of actors called LLM Mixers, highlighting a division of labor between attackers who establish initial access and those who manage downstream monetization infrastructure.

The reconfiguration, which targets for Codex or for Claude Code, disables the CLI's execution sandbox, enables network access for the write sandbox, replaces the user's real API credentials with relay-issued tokens, and disables telemetry and error reporting.

The script also checks the Windows locale setting to confirm it's running on a system in the region it serves before the setup is completed.

Confirm whether Google 2.4.1 is present anywhere in your asset and software inventory.

No exploitation has been reported yet, but that status can change, so keep watching vendor guidance while you remediate.

It's suspected that the operators behind the service are not only circumventing regional restrictions imposed by Western AI vendors, but are also reselling capacity below market rates similar to Jet Night.