Stolen AI keys can run up $100,000 a day. Google has seen it hit $1 million.
By Lior AharonovFounder, 7IT Solutions ·
What happened
Google's Threat Intelligence Group and Mandiant report LLMjacking: attackers steal cloud credentials or LLM API keys and resell the access. BleepingComputer reports fraudulent charges above $100,000 in a day, and about $1 million in total at some organizations.
Why it matters
The provider sees valid requests and bills you for every token. You find out when the invoice lands, after the attacker is long gone.
What to do
Set hard spending limits on every AI API key today, rotate keys kept in repos or laptops, and turn on audit and inference logs so a spike pages someone.
My take
Lior Aharonov
Founder, 7IT Solutions
A leaked AI key is a blank cheque with your name on it. The limit you skip today is the invoice you open later.
Sources
| BleepingComputer: Google says LLMjacking attacks rack up $1 million in cloud AI charges | bleepingcomputer.com |
Researched with AI tools; every fact is checked against the linked sources.