Originally published at ConvertElementor.

LLMjacking is real — and it is expensive. Attackers are stealing AI API keys and using them to run up enormous bills, in one case $1 million in a single day.

Google and Mandiant documented the pattern: stolen keys are not just used quietly. They are burned at maximum rate, often to resell access or to run large workloads on someone else's account, before the owner notices the bill.

How it happens

  • API keys leak in code, repos, logs and shared prompts — then get harvested automatically.
  • Attackers use the stolen keys to call expensive models at scale, racking up charges in hours, not weeks.
  • The victim often discovers it from the bill, after the damage is done.

What developers should do

  • Treat AI API keys like production passwords: never commit them, never share them in screenshots or prompts.
  • Rotate keys, restrict them by IP or usage, and set hard spending caps and alerts on every AI account.
  • Monitor usage daily — a sudden spike is a breach, not a bug.

If your app calls an AI API, your keys are a target. Secure them the way you would secure a database password.

Read the full article on ConvertElementor: https://convertelementor.com/blog/llmjacking-is-real-stolen-ai-keys-ran-up-1-million-bills-in-a-day-what-google-and-mandiant-found-november-2026-20261105