LLMjacking: How Attackers Turn Your AI API Keys Into a $1M Cloud Bill

What LLMjacking actually is

LLMjacking turns three things everyone in your engineering org already has — API keys, AI gateways, and a monthly cloud invoice — into direct revenue for the attacker. The playbook is simple and now at industrial scale: compromise a key, route traffic through a proxy to launder it, bill the victim, pocket the resale margin. The novelty is that the resale market is now mature. Token-routing services marketed as "LLM mixers" sit in front of pools of stolen credentials, sell subscriptions on the open internet, and present the whole thing as a legitimate "unlimited AI" offering to their end customers. The current benchmark price — Jet Night and peers — is roughly $60/month for all-you-can-eat access to frontier models that would cost thousands at list price.

The economics of a $1M bill

Mandiant's case data tells a specific story:

• One actor burned ~$1,000,000 of a victim's cloud-AI budget in a single incident.
• The spike came from 500,000+ API calls in roughly 8 hours — ~17 calls/sec sustained across many parallel connections.
• Short-window bursts reached 1,000+ requests/sec on a single stolen key.
• Peak daily damage per victim has crossed $100,000/day.

These numbers sit inside the normal shape of legitimate API consumption. Cloud bills do not alert at 17 calls/sec — many production AI products do more than that. The attacker's disguise is volume at a plausible shape, not exotic request patterns.

How attackers get in

Google groups the entry points into two loose categories:

CVE-2026-40217: RCE in LiteLLM's custom-code guardrail testing endpoint

LiteLLM is the open-source AI gateway/router that many teams put between their application and the raw LLM provider APIs. CVE-2026-40217 is a critical remote-code-execution flaw in the endpoint LiteLLM exposes for testing custom-code guardrails. The feature's job is to let an operator paste a block of Python that validates model inputs and outputs — and to execute it. In the vulnerable builds the endpoint accepted untrusted input (no server-side gate preventing an unauthenticated or low-privileged caller from submitting arbitrary code) and executed it with the host process's privileges.

Once the attacker owns the LiteLLM host, the LLM key store is not a secondary target — it is the primary target. Every API key for every downstream provider the gateway routes to is now in the attacker's hands, and the gateway's own egress IPs make the stolen traffic look even more legitimate than if they were calling the providers directly.

What to do in the next 72 hours

1. Patch LiteLLM. Upgrade to the fixed release for CVE-2026-40217. Audit your LiteLLM deployments — Docker images, Kubernetes pods, and anything a developer spun up on a dev VM. If you cannot patch immediately, disable the custom-code guardrail testing endpoint and bind the LiteLLM admin interface to loopback or a private network only.
2. Rotate AI provider keys for OpenAI, Anthropic, Google, AWS Bedrock, Azure OpenAI, Cohere, and any first-party provider. Prioritise keys issued before 24 October 2026 or stored anywhere a LiteLLM host, CI runner or developer machine could reach.
3. Cap spend per key at the provider layer. Set hard budget limits on AWS Cost Anomaly Detection, GCP billing budgets, Azure cost alerts, OpenAI project limits, and Anthropic workspace caps. $1,000,000 of damage requires the victim to be willing to spend $1,000,000 — a hard cap turns a nine-figure headline into a thousand-dollar incident report.
4. Alert on request-rate and spend shape. The signal is "sustained high-volume requests from an unusual egress IP" and "sudden spend ramp on a key that normally runs flat." Both are easy wins in your existing SIEM once you decide to look.
5. Hunt in access logs. For the last 30 days: unknown IPs hitting LiteLLM's /guardrails, /test or admin endpoints; successful 200 responses on model-completion routes from source IPs outside your known client ranges; and any outbound connections from LiteLLM hosts to unfamiliar destinations.
6. Lock down the gateway's blast radius. The LiteLLM host should not have ambient cloud credentials beyond what it strictly needs to route to providers. If it does, trim them — a fully compromised gateway with over-broad IAM is how LLMjacking turns into a full-cloud compromise.

Why this is a direct money risk, not a theoretical one

Traditional cloud intrusions take time to monetise: deploy a cryptominer, build botnet capacity, exfiltrate data and find a buyer. LLMjacking skips every one of those steps. The resale market is running right now at $60/month per end-customer, and the victim pays the cloud bill in real time while the attacker clears the resale revenue. For a mid-sized SaaS team with a non-trivial AI product, a single weekend of unnoticed LLMjacking can clear the annual AI budget. For an enterprise with no spend caps set, it can cross seven figures in days — which is exactly what Google's reporting shows.

How TigerGate helps

• AI Security finds exposed LLM gateways — LiteLLM, Ollama, vLLM, LocalAI, OpenWebUI — on your perimeter and in your clouds, and flags the specific admin / guardrail-testing routes that CVE-2026-40217 targets.
• AI Security Posture Management (AI-SPM) inventories AI provider keys (OpenAI, Anthropic, Google, Bedrock, Azure OpenAI), which workloads hold them, which have been rotated recently, and which have spend caps set at the provider.
• Secrets scanning catches AI API keys committed to source, embedded in container images, or left in CI logs — the credential-theft side of the LLMjacking funnel.
• CSPM surfaces Bedrock, Vertex and Azure OpenAI access policies that are too broad, service accounts without budget alerts, and AI endpoints reachable from 0.0.0.0/0.
• eBPF runtime detection flags anomalous outbound traffic from LLM gateway hosts (sustained 1000 req/s to api.openai.com or api.anthropic.com from a single pod is a very loud signal) and child-process executions inside LiteLLM containers that would indicate CVE-2026-40217 exploitation.

Sources

• BleepingComputer: Google — LLMjacking attacks rack up $1 million in cloud AI charges
• Google Threat Intelligence Group and Mandiant research briefings, October–November 2026
• CVE-2026-40217 at NVD (pending)