There’s a new flavor of AP fraud in town, and it’s all about AI. Cybercriminals have found a way to monetize stolen corporate artificial intelligence infrastructure in real time, selling unauthorized access to large language models (LLMs) while the companies whose credentials were compromised absorb the charges.
A Monday (Nov. 2) report from Google’s cyber threat intelligence division exposes a new blind spot in corporate finance: AI spending can become a fraud liability long before it appears on an invoice. In its report, Google’s cyber team documented incidents in which fraudulent AI consumption exceeded $100,000 in a single day, with cumulative charges at some organizations reaching $1 million before access was revoked.
The attacks, known as LLMjacking, have affected financial services, retail, technology and transportation companies across multiple continents. For CFOs, the attacks expose a weakness in the financial controls surrounding consumption-based AI infrastructure, where an authenticated software request can trigger a billable expense without anyone in finance approving the transaction.
The result is an emerging category of operating expense fraud in which criminals capture the economic value of corporate resources while transferring the cost directly to the victim.
That, just as it sounds, is something good for the criminal but bad for the company.
Read more: Quantum, Crypto and AI Are Repricing the Enterprise Cybersecurity Budget
Cybercrime Discovers a Pay-as-You-Go Business Model
Traditional financial cybercrime often involves stealing money, extracting sensitive information or demanding ransom. LLMjacking offers another route to monetization by stealing access to something that already has a measurable market price.
Unlike ransomware, which requires victims to agree to pay, LLMjacking exploits infrastructure that automatically generates charges as it operates. Premium AI models charge for processing requests, often based on the volume of input and output tokens consumed. With valid credentials, attackers can generate enormous volumes of requests against an organization’s cloud account.
Data from the PYMNTS Intelligence report “When ‘Good Enough’ Isn’t Enough: Digital Identity Verification in the Age of Bots and Agents” revealed in January that financial services firms lose nearly $34 billion in revenue because of identity verification failures.
Some attackers concentrate on acquiring credentials or compromising cloud environments. Others operate what researchers call “LLM Mixers,” intermediary services that aggregate stolen credentials and resell access to AI models at discounted prices.
One such service, Jet Night, advertised unlimited access to frontier models for approximately $60 per month. Google researchers linked the service to an attacker that generated more than 500,000 API calls in less than eight hours, passing nearly $1 million in token costs to a victim organization.
This is what makes LLMjacking different from conventional cloud resource theft. The stolen product is not simply computing capacity. It is the victim’s ability to purchase expensive AI services on demand.
Read also: The New Cyber Math for CFOs: One Attack, Hundreds of Disclosures
Authentication Is Becoming Crucial to Financial Authorization
According to Google’s findings, rather than defeating sophisticated AI safeguards, many exploit familiar weaknesses such as exposed API keys, compromised service accounts, stolen identity tokens and credentials embedded in software repositories. Once inside, attackers can sometimes expand their privileges, activate previously unused AI services or create additional credentials.
In one case, attackers enrolled compromised accounts in pay-as-you-go agreements, selected premium foundation models and generated high-volume inference traffic. They also created and deleted short-lived service accounts to evade rate limits and maintain access.
A cloud platform may correctly authenticate an API request and bill the associated account. But successful authentication does not establish that the business authorized the underlying expense. For finance teams, this raises a question familiar from accounts payable controls: Who is authorized to incur an expense, and what prevents spending beyond that authorization?
In cloud environments, those controls increasingly need to operate at the level of service accounts, API credentials, model permissions and usage quotas rather than purchase orders alone.
The PYMNTS Intelligence report “Payment Protection: Why Firms Still Aren’t Real-Time Ready” found in August that 65% of firms plan to adopt or expand identity verification and know your customer (KYC) automation within the next 12 months.
For CFOs, the larger implication is that consumption-based artificial intelligence is changing the boundary between cybersecurity and financial control. Google expects the criminal marketplace for stolen AI access to expand as premium models and autonomous workloads become more widely deployed.
The same infrastructure that allows businesses to purchase intelligence instantly can allow criminals to consume it just as quickly. And when the bill arrives, the cloud provider may have delivered exactly what the account requested.
The unanswered question is whether the company ever intended to buy it.
For all PYMNTS digital transformation and B2B coverage, subscribe to the daily digital transformation and B2B newsletters.
