LLMjacking attacks have caused over $1M in cloud AI bill losses

On November 2, 2026, Mandiant and Google Threat Intelligence Group, both part of Google LLC, published a report titled "The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources." The report describes a new cloud-focused abuse pattern in which attackers hijack enterprise access to large language models and rack up fraudulent cloud charges exceeding $100,000 in a single day. According to the findings, compromised accounts and model resources are being monetized through attacker-controlled usage, generating substantial billing volume before organizations detect the intrusion.

SiliconANGLE covered the report the same day, framing it as the first public evidence of LLMjacking activity reaching that financial scale. No additional sources or follow-up disclosures have appeared since, so the incident remains at the stage of a single vendor report. No technical indicators of compromise, affected customer names, or specific detection and response guidance were included in the available material. The report does not indicate whether the charges stemmed from token consumption, API abuse, or provisioning of compute for other purposes. The claim of more than $100,000 in daily fraudulent cloud charges is attributed to Mandiant and Google Threat Intelligence Group; the material reviewed does not include independent confirmation of the figure, and no conflicting estimates are available. As of the time of writing, no further developments have been reported.