Hackers "hijack" access to AI: bills reach $100,000 within minutes. Google warns of a growing new type of attack - LLMjacking.

Attackers steal API keys for language models and cloud credentials to run AI workloads at someone else's expense and sell access to others.

First, hackers look for open LLM endpoints or valid keys, and then, using stolen tokens (IAM, service account keys, GitHub PATs), they gain a foothold in the victim's infrastructure and escalate their privileges.