{"rewrite":{"id":"r_4a2a5ed3dae71330096a27ec","clusterId":"c_2ec52ebefe2651ed14efce39","slug":"google-threat-intelligence-group-analyzes-llmjacking-key-theft","model":"deepseek-v4-1-flash","headline":"Google Threat Intelligence Group Analyzes LLMJacking Key Theft","summary":"Google Threat Intelligence Group and Mandiant published an analysis of LLMJacking, an attack that steals cloud API credentials and resells access to frontier models. Keys are pulled from public GitHub repositories or taken by session hijacking, then pooled into proxy gateways sold on underground marketplaces. Google cites one victim billed more than $100,000 a day before access was stopped, and another attacker who made over 500,000 LLM API calls in under 8 hours.","whyItMatters":"The report puts dollar figures on credential theft: stolen keys resold for about $60 a month ran one victim's model usage bill to roughly $1 million, which makes key scoping and usage limits a billing problem as much as a security one.","webCardHtml":"\u003cp\u003eAttackers also probe Ollama servers left exposed online, sending requests to test whether they can create models without authorization, and use short-lived service accounts created and deleted to dodge rate limits while they watch the cloud billing dashboard. The affected organizations sit in financial services, retail, technology, and transportation across North America, South America, and the Asia-Pacific region. Google\u0026#39;s recommended countermeasures are detecting shadow LLMs, setting fine-grained API key permissions, and scanning automatically for sensitive information.\u003c/p\u003e","blueskyPost":"The $100,000-a-day victim shows LLMJacking's economics: attackers buy stolen keys for $60 a month and resell proxy access. The cost to the victim is set by the attacker's markup, not the model's price.","twitterPost":"LLMJacking flips the cost curve: stolen keys resold at $60 a month, one victim billed over $100,000 a day.","threadsPost":"Google Threat Intelligence Group's LLMJacking writeup shows where the damage lands: keys pulled from public GitHub repos and session hijacking, then resold through proxy gateways at $60 a month. One victim was billed over $100,000 a day before access was stopped.","newsletterBlurb":"Google Threat Intelligence Group and Mandiant published an analysis of LLMJacking, in which stolen cloud API keys are pooled into proxy gateways and resold. Google cites a victim charged over $100,000 a day and an attacker who made more than 500,000 LLM API calls in under 8 hours. Recommended fixes are shadow LLM detection, fine-grained key permissions, and automatic sensitive data scanning.","attributionJson":"[{\"source\":\"GameBusiness.jp\",\"url\":\"https://www.gamebusiness.jp/article/2026/11/05/28550.html\",\"title\":\"Google analyzes \\\"LLMJacking\\\" tactics: stolen AI keys resold for $60 a month, with damages exceeding $100,000 a day\"}]","lintFlagsJson":null,"lintHits":0,"costUsd":0,"inputTokens":5465,"outputTokens":708,"status":"published","repairAttempts":0,"nextRepairAt":null,"factsAttemptedAt":1793833491,"createdAt":"2026-11-04T22:59:05.000Z","publishedAt":"2026-11-04T23:03:51.000Z","updatedAt":"2026-11-04T23:03:51.000Z"},"cluster":{"id":"c_2ec52ebefe2651ed14efce39","canonicalTitle":"Googleが「LLMJacking」の手口を分析、盗んだAIの鍵を月60ドルで転売して1日10万ドル超の被害も","representativeArticleId":"a_4f677024e0b5c1a182289d7b","sourceCount":1,"writtenSourceCount":1,"writeAttempts":0,"isSolo":true,"entitiesJson":"{\"anime_titles\":[],\"manga_titles\":[],\"work_titles\":[],\"studios\":[],\"people\":[],\"type\":\"news\",\"domain\":\"other\",\"is_roundup\":false}","contentType":"news","status":"published","firstSeenAt":"2026-11-04T22:15:02.000Z","lastSeenAt":"2026-11-04T22:15:02.000Z","updatedAt":"2026-11-04T23:03:52.000Z"},"attribution":[{"source":"GameBusiness.jp","url":"https://www.gamebusiness.jp/article/2026/11/05/28550.html","title":"Googleが「LLMJacking」の手口を分析、盗んだAIの鍵を月60ドルで転売して1日10万ドル超の被害も"}],"entities":{"anime_titles":[],"manga_titles":[],"work_titles":[],"studios":[],"people":[],"type":"news","domain":"other","is_roundup":false},"keyFacts":["Google Threat Intelligence Group and Mandiant published a blog post analyzing LLMJacking.","Attackers obtain keys from public GitHub repositories or by hijacking sessions.","One investigation found unauthorized charges over $100,000 per day before access was stopped, with cumulative damage of $1 million.","One attacker made more than 500,000 LLM API calls in less than 8 hours.","Affected organizations are in financial services, retail, technology, and transportation in North America, South America, and the Asia-Pacific region."],"pageLinks":{"healthSlugs":[],"storySlugs":[],"entities":[],"stories":[],"entitiesOk":true,"storiesOk":true}}