Google Cloud, part of Alphabet Inc. (NASDAQ: GOOGL), has documented a pattern of intrusions in which attackers hijack enterprise access to large language models and rapidly run up fraudulent cloud charges. Google Threat Intelligence Group said individual LLMJacking incidents produced more than $100,000 in resource consumption in a single day, while cumulative charges at some affected organizations reached $1 million before access was revoked.
The research gives security and cloud-operations teams a more specific risk to monitor as AI services move into production. Rather than using an organization’s approved chatbot interface, attackers seek direct access to backend model resources through exposed endpoints, cloud identity credentials or LLM application programming interface keys. The resulting usage can create a financial incident within hours, according to the company.
Google said the most common initial-access route in the cases it investigated involved exposed or stolen cloud identity tokens. Those included IAM credentials, service-account keys, GitHub personal access tokens and active sessions. In other cases, actors harvested exposed corporate LLM API keys from public code repositories, then used minimal one-token requests to validate keys while avoiding volume-based alerts in endpoint-detection and SIEM systems.
The intrusions did not stop at a single model credential. Google described attackers enumerating cloud services, repositories and data stores for more secrets, then using identity permissions and virtual-machine configurations to escalate privileges and maintain access. In one case, an actor combined a stolen repository token with exploitation of a suspected web-application vulnerability in a package running in a containerized cloud environment.
After gaining access, the actors enabled generative-AI services, created additional API keys and launched high-volume inference streams, Google said. The company also observed a “burn and rotate” approach in which attackers repeatedly created and deleted short-lived service accounts while checking billing interfaces. Other activity included unauthorized IAM accounts, administrative role changes and SSH-key injection into compute instances.
The monetization model extends beyond an attacker consuming a victim’s compute for its own work. Google said some groups used proxy and routing infrastructure to aggregate stolen credentials, meter requests and resell access to subscribers. One actor made more than 500,000 LLM API calls in fewer than eight hours and passed nearly $1 million in token costs to the affected organization, according to the company.
For security operations teams, the findings connect several controls that are often managed separately: cloud-identity permissions, source-code secret handling, model API keys, service enablement and billing telemetry. An investigation limited to unusual login activity or high model-request volume may miss an early indicator such as an unauthorized service-account change or a newly enabled AI service.
Google advised defenders to treat modifications to LLM accounts and services as critical security events and to prioritize visibility into abuse of cloud LLM platforms. The company said some affected environments had not enabled LLM services before compromise; stolen access keys let attackers activate them. That makes governance over identity privileges and service activation as relevant to AI cost control as it is to conventional cloud security.
The report does not establish that every large AI bill signals compromise. It does show that production AI environments add a route for attackers to convert a credential failure into immediate, measurable cloud spending. For organizations deploying model APIs and agentic workloads, that raises the value of correlating identity changes, API consumption and billing signals before the activity becomes a costly incident.