Enterprises pay $100,000 a day for AI they never ordered
Enterprises deploying large language models (LLMs) in production may be unknowingly footing the bill for someone else’s AI business. Google Threat Intelligence Group (GTIG) is warning of financially motivated LLMjacking campaigns in which cybercriminals hijack enterprise cloud and model access before reselling it through underground subscription services. The activity can generate fake cloud charges exceeding $100,000 in a single day, GTIG said in a blog post . In some incidents, cumulative charges reached $1 million before organizations revoked the compromised access. “LLM Mixers turn stolen enterprise model access into a service for paying customers, while the victim’s systems continue accepting requests through credentials they recognize,” said Piyush Sharma , co-founder and CEO at Tuskira. “That puts a lot of weight on the authority attached to each credential. A key issued for one application shouldn’t become a reusable pass to other models and workloads.” GTIG’s analysis is based