Someone Else Can Run AI on Your Bill. Find Your AI Keys This Week.
Criminals are using stolen cloud logins and AI keys to run up charges of $100,000 a day. Here is the list to make, the caps to set and the questions to ask.
By John Martines · November 5, 2026 · 6 min
Google's threat researchers found criminals running AI on other companies' accounts, with bills reaching $1 million before anyone noticed. If anyone ever set up an AI key for your business, here is what to check, in order.
A contractor's office manager opens the monthly card statement and finds a charge from Google Cloud she doesn't recognize. It is several thousand dollars. Nobody in the office uses Google Cloud, as far as anyone knows.
Then someone remembers. Two years ago a web developer built a "get a quote" chatbot for the website. He set up a cloud account with an AI key, put it on the company card, and moved on. The chatbot was retired last spring. The account and the key were not.
That story is a composite, but the pattern is real, and this week Google put numbers on it.
An AI key (also called an API key) is a long password that lets software use an AI model and send the bill to whoever owns the key. Your website chatbot, your scheduling tool's "AI assistant" or an automation your developer built may each run on one.
LLMjacking is the name for stealing that access. An LLM is a large language model, the kind of AI behind ChatGPT, Claude and Gemini. Criminals get a working key or a cloud login, then run AI on it, for themselves or for paying customers. The victim gets the bill.
In a report covered on November 3, 2026, Google's Threat Intelligence Group and its Mandiant incident team described what they found when they responded to these break-ins this year:
- Bills of more than $100,000 in a single day in some cases, and up to $1 million in some attacks before the attackers lost access.
- The most common way in was a stolen cloud credential: a service account key, a GitHub access token or an active session token. One group harvested AI keys left in public code on GitHub.
- In several cases the AI services had been switched off. The attackers used the stolen keys to switch them on.
- Stolen access gets resold. One resale service, which Google calls an "LLM Mixer," offered an "unlimited" AI plan for about $60 a month. One of its suppliers made more than 500,000 calls to AI models in under eight hours, leaving one company with nearly a million dollars in charges.
Unlike older attacks that quietly used a victim's computers for months, this one, the researchers said, can produce huge charges "in a matter of hours."
How it got here:
- May 2024: Security firm Sysdig named the attack "LLMjacking" after finding stolen cloud logins used to reach AI models from Anthropic, OpenAI, Amazon, Microsoft, Google and others.
- December 2024 to February 2025: Microsoft sued a group it tracks as Storm-2139, which used API keys stolen from Microsoft customers to get into its Azure OpenAI service and resold the access.
- November 2026: Google's researchers reported bills of $100,000 a day and an organized resale market.
You may think this is a big-company problem. The victims Google named were in finance, retail, technology and transportation. But the way in is something small businesses have plenty of: keys and accounts set up by someone who has since moved on.
Three things make a small office an easy mark.
Nobody owns the keys. A developer, a website plugin, a chatbot vendor or a curious employee set them up. No one wrote them down. When the person left, the key stayed.
The bill goes on a card nobody watches daily. A big company has someone who reads the cloud bill. In a 20-person business, the first sign may be a declined card or a statement at the end of the month.
A "turned off" service isn't safe. Google found attackers switching AI services back on. An old account with a card attached is a live risk even if you stopped using it.
You don't need to understand cloud security to fix most of this. You need a list, a cap and one rule.
1. Make the key list. Fifteen minutes with whoever handles your website and software. One row for each AI or cloud account: OpenAI, Anthropic (Claude), Google Cloud, Microsoft Azure, Amazon Web Services, a website chatbot, an automation tool. Write who set it up, which card pays for it, who can sign in, and when it was last used. Check your card statements for the last year to catch the ones nobody remembers.
2. Close what nobody can explain. If no one can say what an account or key is for, delete the key and close the account, or remove the card. A key you delete can't be stolen. If your developer still needs it, they will tell you quickly.
3. Set a spending cap or an alert on everything you keep. Most AI services let the account owner set a monthly limit or a billing alert. The Claude Console, for one, lets you cap spending for each workspace. Know the difference: on Google Cloud, a standard budget only sends alerts and does not stop spending on its own, so ask your IT partner what will actually stop the charges. Even an alert you never hit turns a $100,000 surprise into a phone call on day one.
4. Turn on two-step sign-in for every cloud and AI account. Most of these break-ins started with a stolen login. Two-step sign-in won't stop every attack, but it stops the cheap ones.
5. Add one line to your staff AI rules. "No AI key, cloud account or AI tool gets put on a company card without the owner's OK and a line on the key list." If you don't have staff AI rules yet, the free [Staff AI Rules Kit](/tools/staff-rules) builds a short set in about ten minutes.
6. Tell the team about fake sign-up pages. One group Google described ran a fake portal for joining an AI users' group and got visitors to paste in text that held a live access token, which let the attackers skip the password and the two-step code. The rule is simple: no real page ever asks you to paste a key, a token or a code to join something. Close it and ask first.
Ask whoever built or runs anything AI-powered for you:
- Which AI or cloud accounts did you set up for us, and whose name and card are they in?
- Where is each key stored? Has any key ever been in code, a shared document or an email?
- Is there a spending cap or a billing alert on each account, and who gets the alert?
- If a key is stolen, how fast can you turn it off, and who would notice the charges first?
- When our contract ends, will you hand over or delete every account and key you created?
Google's researchers expect this to grow. As more businesses wire AI into their websites and daily work, there are more keys to steal, and the resale market lets criminals cash in quickly while the victim pays.
The fix is not to avoid AI. It is to treat an AI key the way you treat a company credit card: you know who has one, what it can spend, and when to cancel it. Make the list this week. For a fuller walk-through of every system that needs an owner, our course [Lock the Doors: AI Security Basics for a Small Office](/courses/ai-security-basics) builds a one-page Front-Door List and a ten-minute weekly check.
---
Sources (checked November 4, 2026). Google Threat Intelligence Group and Mandiant findings, including the $100,000-a-day and $1 million figures, the ways in, services switched on by attackers, the Jet Night resale service, the 500,000 calls, and the fake sign-up portal: "Stolen AI access leaves companies with cloud bills of up to $1 million" (Help Net Security, Nov 3, 2026); also reported by GBHackers, "Google Warns of LLMJacking Attacks That Generate Over $100,000 in Cloud AI Bills Per Day" (Nov 2026). The name and first findings: "Researchers Uncover 'LLMjacking' Scheme Targeting Cloud-Hosted AI Models" (The Hacker News, May 10, 2024, on Sysdig's research). Microsoft's case: "Microsoft sues 'foreign-based' cyber-crooks, seizes sites used to abuse AI" (The Register, Jan 13, 2025) and "Disrupting a global cybercrime network abusing generative AI" (Microsoft On the Issues, Feb 27, 2025). Google Cloud budgets send alerts and don't cap use: "Protect your Google Cloud spending with budgets" (Google Cloud blog). Claude workspace spending limits: Claude Help Center.