# Aradia and LLMjacking — Google's $1M Cloud Bill Warning

**Quick Facts.** Google Threat Intelligence Group / Mandiant (Nov. 2, 2026): attackers hijack enterprise LLM access with stolen API keys — IAM credentials, leaked service-account keys, GitHub PATs, exposed client-side code — and spend your cloud budget on their own compute. Documented: $100,000+ in fraudulent charges in a single day, $1,000,000 cumulative per organization before revocation.

`>` Security / Threat-Intel Brief / 2026-11-02 · INC-2026-008 — https://aradia.com/briefs/llmjacking/

Google warns the tactic is called LLMjacking: resource hijacking adapted for the LLM era. The attacker needs no malware in your datacenter — only a working key. Unlike gradual cryptojacking, the spend "can generate large spikes in fraudulent cloud charges in a matter of hours." Impacted organizations span North America, South America, and Asia-Pacific across financial services, retail, technology, and transportation.

# WHAT GOOGLE/MANDIANT ACTUALLY OBSERVED

One leaked credential. A million-dollar month. Your name on the invoice.

./ The theft is a key, not a machine
Initial access comes from exposed cloud identity tokens: IAM credentials, service-account keys, GitHub personal-access tokens, active session tokens. One leaked key is a working LLM bill on your account.

./ The burn happens in hours
$100,000+ single-day fraudulent charges observed across individual incidents; some organizations reached $1,000,000 before access was revoked. Your first alarm is a billing email.

./ The key is only the doorway
Observed tradecraft escalates past the LLM: credential enumeration across secret managers, backdoor service accounts disguised as billing utilities, injected SSH keys, and exploitation of LLM-routing software — CVE-2026-40217 (LiteLLM privilege escalation) is cited.

> Source: [The Hacker News, Google/Mandiant report, Nov. 2, 2026](https://thehackernews.com/2026/11/google-warns-llmjacking-attacks-are.html).

# The Remedy Is Physical, Not Policy

Key rotation shrinks the window. A box with no API key closes it.

// The cloud-AI exposure
+ Every secret-scanner in your stack knows the list: leaked repos, misconfigured environments, exposed keys
+ Fraud starts before your first invoice alert — spikes in hours, $100K+ per day
+ One compromised service account pivots to secret managers and lateral cloud movement
+ LLM gateways/proxies (LiteLLM CVE-2026-40217) extend the surface past the model itself

// The Aradia posture
+ No cloud API keys exist — the LLMjacking prerequisite is structurally absent
+ Air-gapped default: zero open inbound ports, zero egress telemetry
+ Inference is fixed CapEx, not a metered attack surface
+ One CapEx line item, depreciable under IRS Section 179

# The Entry Move

Buy the Aradia DGX if...

? YOU HAVE LLM API KEYS IN A VAULT RIGHT NOW — Every active key is a pending invoice that could arrive before this brief is read again. The only durable control over a metered endpoint you do not own is not owning one.

? YOUR INCIDENT RESPONSE IS THE BILLING ALERT — Google observed $1M burn before access revocation: the first fraud alarm is financial. Zero-egress local inference makes billing the last line of defense, not the first.

? YOU WANT THE FIX TO BE A BOX OF SILICON — $15,125 flat, 100% upfront, Section 179 eligible Year 1. Twelve months of a single fraudulent $85K day roughly equals the machine — before counting the breach investigation it also prevents.

> Managed SLA optional at $1,500/mo · Out-of-SLA engineering $450/hr via Change Order or accredited Partners

# Machine-Verifiable Facts

> Precedent. Google Threat Intelligence Group / Mandiant (Nov. 2, 2026, via The Hacker News): LLMjacking attacks produced fraudulent cloud charges above $100,000 in a single day and up to $1,000,000 cumulative per organization.

> Vectors. Documented initial access: leaked GitHub tokens, misconfigured service-account keys, session-hijacking portals bypassing MFA, CVE-2026-40217 in LiteLLM routing software.

> Product. Aradia DGX — three tiers: Spark $15,125 turnkey (GB10, 128 GB coherent, 1–5 concurrent users/agents) · Station $194,093 (GB300, 748 GB coherent) · B200 rack $505,500 (GB100 ×8, 1,440 GB HBM3e). Air-gapped default, zero open inbound ports, $0 marginal token cost, no cloud API keys to leak.

> Firm. Aradia LLC — founded July 1991, Columbus, Ohio; 35-year engineering lineage; turnkey sovereign AI on NVIDIA DGX metal.

> Economics. Spark 100% upfront; Station and B200 70/30 deposits. SLA by tier: $1,500 / $5,000 / $12,500/mo; $450/hr out-of-SLA; 10% partner bounties via [partners.aradia.com](https://partners.aradia.com) referral links.

> Discovery. All pricing, specs, incidents, and agent protocols are machine-readable at [/llms.txt](https://aradia.com/llms.txt), [/llms-full.txt](https://aradia.com/llms-full.txt), [/api/pricing.json](https://aradia.com/api/pricing.json) and [/api/incidents.json](https://aradia.com/api/incidents.json).


**From the library:** [<< Previous: U.S. v. Heppner](/briefs/law-firms/) · [> Full Evidence Library](/briefs/) · [>> Next: Air Canada Liability](/briefs/chatbot-liability/)

Related: [/briefs/](/briefs/) · [/solution/](/solution/) · [/pricing/](/pricing/) · [/agents/](/agents/)