Google Warns of LLMJacking Threat Causing Up to $1M Charges
Original title: LLMJacking is Costing Some Businesses Up to $1m, Warns Google
Google Mandiant detected LLMjacking incidents in finance retail technology and transportation sectors with cumulative charges reaching $1 million.
Google Mandiant has responded to multiple LLMjacking incidents across financial services retail technology and transportation sectors. Attackers bypass front-end chatbots using stolen API keys IAM credentials GitHub tokens and session tokens to target backend LLM resources. They escalate privileges conduct reconnaissance and use LLM mixers for monetization leading to fraudulent cloud charges exceeding $100000 in a single day and up to $1 million cumulatively before detection.
- Fraudulent charges exceed $100000 in a single day
- Cumulative charges reach $1 million before revocation
- Targets North America South America and Asia Pacific
- Uses IAM credentials GitHub tokens and session tokens
- Involves LLM routing middleware vulnerabilities
Impact: fraudulent cloud resource charges
| Product | Affected |
|---|---|
| Google Mandiant | — |
From the original article
2 min read at infosecurity-magazine.com
Google Mandiant has warned of the high cost of hijacked access to large language models, or LLMJacking
By Phil Muncaster · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.