The report
A stolen cloud credential can be monetized without extracting the model itself. Google Threat Intelligence described an attack in which a compromised customer's AI-service access was used for more than 500,000 model requests in under eight hours, generating estimated victim-side charges near US$1 million. The LLMJacking Case distinguishes that billed consumption from profit received by the attacker.
The key is the billable resource
The reported operations used stolen service credentials or exposed endpoints to reach hosted models through legitimate provider routes. Attackers could validate usable keys with minimal requests, then route heavier inference through the compromised identity. The defender's cloud logs might show legitimate model APIs making successful calls even though their caller had no authorization from the account owner.
Google also investigated services advertising access to multiple expensive models at prices inconsistent with ordinary retail inference. It identified Jet Night as one such advertised offering, reportedly around $60 per month for an unlimited tier. An advertised price is not proof of sales, of the source of every token the service served, or of realized criminal proceeds.
What to separate in the evidence
A provider's estimated charge, requests observed in a time window and an illicit gateway's advertised price have distinct denominators. The first measures an account's exposure to a bill, the second measures usage, and the third measures marketing. It would be incorrect to add them together as confirmed financial loss.
This case is AI-specific because the stolen authority was used to invoke billable inference at high volume, sometimes through resale infrastructure. The most direct controls are user and service-principal scoped model permissions, spend and request limits, key rotation and monitoring of newly enabled models and unusual invocation bursts. Google's first-party report supplies the observed sequence and its limits.