Google has warned that attackers are increasingly stealing or buying leaked API keys to ride enterprise LLM subscriptions for free, a technique researchers call LLMjacking. Keys get exposed through phishing, source-code leaks, misconfigured cloud environments, and client-side code, after which the attacker routes their own usage through the victim's account. Some organizations have reportedly been billed as much as $1 million in fraudulent cloud AI charges because of the abuse.
// source: thehackernews.com ↗