LLM hijackers rack up more than $100,000 in cloud charges in a single day

Google's Mandiant reviewed cases in which some organizations' fraudulent cloud bills reached $1 million before access was revoked. Attackers also targeted internet-exposed model servers, and Google identified a growing split between those who break in and operators who resell access. In one case, an intruder made more than 500,000 model API calls in under eight hours using stolen keys.