LLMjacking attacks cost enterprises up to $1M in cloud charges

Google warns that threat actors are hijacking enterprise LLM access to fraudulently consume expensive cloud computing resources in attacks called LLMjacking. Attackers obtain API keys via phishing, code leaks, misconfigurations, or exposed client-side code, then run unauthorized AI workloads. Organizations should audit API key access, enforce strong authentication, monitor cloud usage anomalies, and implement resource limits.