Google’s Mandiant incident responders published figures on Monday that should reframe how finance and security teams read a suspicious cloud bill. Enterprises have been losing more than $100,000 a day to criminals spending their AI budget, with cumulative charges at some victims touching $1 million before access was revoked.
The technique is LLMjacking, an adaptation of cryptojacking aimed at model inference rather than GPUs. An intruder steals an API key through a leak, a misconfigured environment, or a cloud identity token, then spends someone else’s account on expensive models.
Mandiant’s casework shows how far that goes. A group it calls UNC6993 used illicit LLM keys to mint fresh keys, enable services in the victim’s cloud projects, and run up $100,000 in charges. Another operator enrolled victim accounts in pay-as-you-go agreements, pointed them at premium foundation models, and ran a burn-and-rotate strategy, deleting short-lived service accounts to dodge rate limits while watching the billing console.
Stopping the bill means treating inference keys like payment instruments. Budget alerts that fire at a fraction of normal spend, keys scoped to one model and one project, and a revocation sweep for credentials held by former contractors all shorten the window before the meter runs into six figures.
The Register notes a 200,000-request burst in two minutes in an earlier CrowdStrike case, and more than 500,000 API calls in under eight hours in another.
Mandiant reported victims across North America, South America, and Asia Pacific, in financial services, retail, technology, and transport. SecurityWeek this week tied the trend to a wave of AI developer platform intrusions at WorkOS, Northflank, Trigger.dev, and Chainstack.
Controls that help: alert on inference spend anomalies, scope API keys to specific models and projects, and revoke every key a departed contractor ever held.
