AI service hijacking is the subject of a warning from Google, according to The Hacker News, in an article dated November 3, 2026. Still according to that outlet, the cloud bill climbs as high as one million dollars at some of the targeted companies.
Key points
- Attackers are hijacking corporate access to AI models to consume costly computing resources, Google warns.
- According to The Hacker News, the cloud bill reaches as much as one million dollars at some affected companies.
- The source does not specify the country or industry of the organizations targeted by these takeovers.
What We Know About the Incident
According to The Hacker News, in an article dated November 3, 2026, Google warned on Monday that attackers are hijacking companies’ access to large language models. The source does not specify where these incidents occurred, nor which industries were affected.
The outlet calls this tactic LLMjacking, describing it as a resource-hijacking scheme adapted to the age of language models. According to the article, an attacker obtains an access key (an API key) through phishing or a source-code leak. It can also be acquired from misconfigured environments or from code exposed on the user side.
An access key works like a corporate credit card for an online service: it unlocks the service and bills usage to its holder. Whoever holds it consumes the service; whoever issued it pays. The source does not specify where these takeovers occurred, and no Canadian case has been established.
AI Service Hijacking Also Affects Small Organizations
An SMB does not need an IT department to be exposed. All it takes is for an employee, a freelancer, or a vendor to have created an AI account for a project, after which the key stayed behind in a shared file or in a website’s code. The account keeps working, and keeps billing.
The cost is not limited to the invoice. An AI account connected to your internal documents can grant access to quotes, client files, or personal information. The resulting loss of trust is measured in clients, not in technical fees. The Canadian Centre for Cyber Security’s baseline cybersecurity controls rank account and access-rights management among the most cost-effective measures for a small organization.
It is also worth recalling that no protection is absolute: no provider can guarantee zero risk in a scenario like this. Sound access management and bill monitoring do, however, make this scenario considerably harder to pull off.
Checks to Run This Week
The simplest signal remains the bill: cloud spending that rises for no known reason deserves a written explanation. The rest mostly comes down to asking the right people the right questions, and the scope of the work depends on how many accounts and keys are circulating within your organization. Start with an inventory, then deal with any access no one can account for.
Ask your IT provider for the complete list of accounts and access keys for the AI and cloud services your business uses. Have that provider revoke any key whose purpose no one can explain, along with keys belonging to former employees or freelancers. Ask accounting to compare the last three cloud invoices and flag any unexplained variance to management. Have a budget-overrun alert activated on every account involved.
FAQ
Can an SMB without an IT person fall victim to AI service hijacking?
Yes. The deciding factor is not company size, but the existence of an active AI or cloud account with a valid access key. Such accounts may have been opened for a website project or to try out a tool, then forgotten, which is exactly what needs to be checked. We recommend inventorying these accounts with your provider, then closing the ones that are no longer in use.
How do we know if our AI account is being used by someone else?
A few signs are worth examining. A bill that rises while your own usage has not changed, usage logged at night or on weekends, or logins from countries where you have no activity. Your IT provider can review the account’s usage history with the vendor and explain it to you in plain terms.
Who pays for cloud charges generated by an attacker?
By default, the account holder. Each provider’s terms of service govern disputes: check what yours say about abnormal charges, without assuming an outcome in advance. The source does not address this question. We therefore recommend capping spending in advance and checking what your insurance covers for computer fraud, before you need it.
Sources
- The Hacker News · press, November 3, 2026
- Canadian Centre for Cyber Security: baseline cybersecurity controls for small and medium organizations · reference checklist
Source: The Hacker News · https://thehackernews.com/2026/11/google-warns-llmjacking-attacks-are.html
This article was prepared by the RISS Canada monitoring team from the public sources cited above, with the assistance of artificial intelligence tools, then reviewed according to our editorial policy.
