{"id":6809,"date":"2026-10-31T01:39:48","date_gmt":"2026-10-31T01:39:48","guid":{"rendered":"https:\/\/i10xnews.kinsta.cloud\/llmjacking-cloud-billing-hijacks"},"modified":"2026-10-31T01:39:48","modified_gmt":"2026-10-31T01:39:48","slug":"llmjacking-cloud-billing-hijacks","status":"publish","type":"post","link":"https:\/\/i10x.ai\/news\/llmjacking-cloud-billing-hijacks","title":{"rendered":"LLMjacking Surges as Hackers Target Cloud AI Bills"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">The era of cryptojacking now has a more profitable successor in LLMjacking. As enterprise-grade AI inference costs climb, attackers have pivoted from hijacking machines to mine cryptocurrency toward draining cloud billing accounts for unauthorized access to premium models. Surging demand for those models has fueled an underground broker network that trades stolen credentials and API keys like liquid assets, leaving victim companies to cover the tab for illicit usage.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u26a1 Quick Take<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>What happened:<\/strong> Threat actors are systematically hijacking cloud billing accounts and developer platforms to funnel unauthorized, high-volume AI inference costs to corporate victims.<\/li><li><strong>Why it matters now:<\/strong> Premium AI access requires vast compute. Attackers exploit cloud credentials to bypass traditional malware defenses, racking up tens to hundreds of thousands of dollars in illicit Gemini or OpenAI usage in mere days.<\/li><li><strong>Who is most affected:<\/strong> Cloud security architects, FinOps teams, and enterprise developers relying on expensive models and AI coding agents like Devin and Cursor.<\/li><li><strong>The under-reported angle:<\/strong> Hackers are operating like illicit SaaS vendors, offering up to 97% discounts on premium AI access complete with replacement guarantees to counter account suspensions.<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">What happened<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Google\u2019s Threat Intelligence Group and Wiz have flagged a sharp rise in stolen AI access on dark-web markets. During the stretch they call \u201cBlack October,\u201d attackers used phishing and infostealers to harvest cloud credentials from AI developer platforms. Once inside GCP or AWS environments, they link projects across tenants or alter IAM policies so expensive APIs such as Gemini or Claude run from attacker-controlled systems while the victim\u2019s account pays the bill. Prices for these brokered accounts reportedly doubled through 2026.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Why it matters now<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The shift tracks directly with the rising cost of high-end model inference. Rather than simply stealing data, attackers now target the compute budgets themselves. Because the activity uses legitimate cloud APIs and valid identities, it evades malware-based detection. Bills can balloon within a 24- to 48-hour window, and because the workloads often run in linked or dormant projects, victims frequently have no visibility into the prompts or outputs involved.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Who is most affected<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The attack sits at the intersection of security and spend, affecting anyone who controls cloud keys or AI platform access.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Stakeholder<\/th><th>Impact<\/th><th>Why<\/th><\/tr><\/thead><tbody><tr><td><strong>Cloud Security &amp; SOC Teams<\/strong><\/td><td>Blind spots in detection<\/td><td>LLMjacking relies on legitimate API usage and IAM policy shifts, generating no traditional malware signatures.<\/td><\/tr><tr><td><strong>FinOps &amp; Cloud Admins<\/strong><\/td><td>Rapid, devastating cost spikes<\/td><td>Attackers exploit high-quota API limits, generating staggering bills in hours before budgets cap the damage.<\/td><\/tr><tr><td><strong>AI Developers<\/strong><\/td><td>Targeted credential theft<\/td><td>Local .env files, browser stores, and GitHub tokens are actively hunted to access tools like Cursor Pro and Devin.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">The Broker Economy of Stolen Intelligence<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The real danger lies in the organized resale layer that has formed around the thefts. Vendors now run what amounts to an \u201cAI-as-a-Service\u201d black market, offering discounted access to models from OpenAI, Anthropic, and Google. To keep customers despite provider suspensions, many brokers include replacement guarantees and basic support\u2014effectively turning the operation into a reliable supply chain that lowers the cost for other criminals to run phishing, extortion, or model development on someone else\u2019s tab.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u270d\ufe0f About the analysis<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This independent i10x analysis synthesizes threat intelligence and market data to provide CTOs, security leaders, and developers with an operational understanding of emerging AI infrastructure risks.<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><a href=\"https:\/\/www.wiz.io\/blog\/from-phishing-to-llmjacking\" target=\"_blank\" rel=\"noreferrer noopener\">From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM Usage | Wiz Blog<\/a><\/li><li><a href=\"https:\/\/www.wiz.io\/academy\/ai-security\/llm-jacking\" target=\"_blank\" rel=\"noreferrer noopener\">What is LLM Jacking? | Wiz<\/a><\/li><li><a href=\"https:\/\/www.donga.com\/en\/article\/all\/20260929\/6401128\/1\" target=\"_blank\" rel=\"noreferrer noopener\">LLM jacking fuels underground market for AI access<\/a><\/li><li><a href=\"https:\/\/dataconomy.com\/2026\/09\/28\/ai-account-theft-llm-jacking-attacks\/\" target=\"_blank\" rel=\"noreferrer noopener\">Google warns of surge in AI account theft and LLM-jacking attacks<\/a><\/li><li><a href=\"https:\/\/dig.watch\/updates\/llm-jacking-blowing-ai-enabled-cybercrime\" target=\"_blank\" rel=\"noreferrer noopener\">LLM-jacking emerges as a blowing form of AI-enabled cybercrime, with underground prices doubled over 2026 | Digital Watch Observatory<\/a><\/li><li><a href=\"https:\/\/labs.cloudsecurityalliance.org\/research\/csa-research-note-llmjacking-cloud-billing-hijack-20261021-c\/\" target=\"_blank\" rel=\"noreferrer noopener\">Cloud Billing Hijacking as LLMjacking<\/a><\/li><li><a href=\"https:\/\/www.wiz.io\/blog\/black-october-for-ai-developer-platforms\" target=\"_blank\" rel=\"noreferrer noopener\">Black October for AI developer platforms<\/a><\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">\ud83d\udd2d i10x Perspective<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">LLMjacking marks a clear step in how threats around AI are evolving: the models themselves have become the most tradable illicit commodity. We&#8217;ve seen security teams begin to treat inference budgets with the same rigor once reserved for data protection. When billing permissions are not locked down as tightly as any other high-value control, the infrastructure is already set up to underwrite the next round of black-market activity.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Attackers have shifted from cryptojacking to LLMjacking, systematically compromising cloud credentials to drain enterprise billing accounts for unauthorized premium AI model access. An organized underground market now resells this stolen compute at steep\u2026<\/p>\n","protected":false},"author":2,"featured_media":6808,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"paper_title":"","paper_url":"","pdf_url":"","doi":"","arxiv_id":"","authors":"","institutions":"","paper_date":"","venue":"","peer_reviewed":false,"code_url":"","data_url":"","funding_coi":"","figure_license":"","paper_license":"","replication":"","study_models":"","study_sample":"","footnotes":"","_yoast_wpseo_primary_category":"28"},"categories":[12,28],"tags":[],"companies":[39,37],"products":[51,49],"class_list":["post-6809","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-policy-safety","category-security-defense","company-anthropic","company-google","product-claude","product-gemini"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>LLMjacking Surges as Hackers Target Cloud AI Bills - i10X News<\/title>\n<meta name=\"description\" content=\"Threat actors hijack cloud billing accounts to run high-volume LLM inference on models like Gemini and Claude, racking up massive unauthorized costs for\u2026\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/i10xnews.kinsta.cloud\/llmjacking-cloud-billing-hijacks\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"LLMjacking Surges as Hackers Target Cloud AI Bills - i10X News\" \/>\n<meta property=\"og:description\" content=\"Threat actors hijack cloud billing accounts to run high-volume LLM inference on models like Gemini and Claude, racking up massive unauthorized costs for\u2026\" \/>\n<meta property=\"og:url\" content=\"https:\/\/i10xnews.kinsta.cloud\/llmjacking-cloud-billing-hijacks\" \/>\n<meta property=\"og:site_name\" content=\"i10X News\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-31T01:39:48+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/llmjacking-cloud-billing-hijacks-title.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1344\" \/>\n\t<meta property=\"og:image:height\" content=\"768\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Christopher Ort\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@i10x_ai\" \/>\n<meta name=\"twitter:site\" content=\"@i10x_ai\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Christopher Ort\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"NewsArticle\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/llmjacking-cloud-billing-hijacks#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/llmjacking-cloud-billing-hijacks\"},\"author\":{\"name\":\"Christopher Ort\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/person\\\/d410bb7ee72febefca2c9c369939219a\"},\"headline\":\"LLMjacking Surges as Hackers Target Cloud AI Bills\",\"datePublished\":\"2026-10-31T01:39:48+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/llmjacking-cloud-billing-hijacks\"},\"wordCount\":696,\"publisher\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/llmjacking-cloud-billing-hijacks#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/llmjacking-cloud-billing-hijacks-title.webp\",\"articleSection\":[\"Policy &amp; Safety\",\"Security &amp; Defense\"],\"inLanguage\":\"en-US\",\"dateModified\":\"2026-10-31T01:39:48+00:00\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/llmjacking-cloud-billing-hijacks\",\"url\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/llmjacking-cloud-billing-hijacks\",\"name\":\"LLMjacking Surges as Hackers Target Cloud AI Bills - i10X News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/llmjacking-cloud-billing-hijacks#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/llmjacking-cloud-billing-hijacks#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/llmjacking-cloud-billing-hijacks-title.webp\",\"datePublished\":\"2026-10-31T01:39:48+00:00\",\"description\":\"Threat actors hijack cloud billing accounts to run high-volume LLM inference on models like Gemini and Claude, racking up massive unauthorized costs for\u2026\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/llmjacking-cloud-billing-hijacks#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/llmjacking-cloud-billing-hijacks\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/llmjacking-cloud-billing-hijacks#primaryimage\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/llmjacking-cloud-billing-hijacks-title.webp\",\"contentUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/llmjacking-cloud-billing-hijacks-title.webp\",\"width\":1344,\"height\":768,\"caption\":\"Illustration: i10X\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/llmjacking-cloud-billing-hijacks#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/i10x.ai\\\/news\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"LLMjacking Surges as Hackers Target Cloud AI Bills\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#website\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\",\"name\":\"i10X News\",\"description\":\"Stay updated with the latest news and announcements from i10X.\",\"publisher\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/i10x.ai\\\/news?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\",\"name\":\"i10X\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/i10x-logo-180.png\",\"contentUrl\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/i10x-logo-180.png\",\"width\":180,\"height\":180,\"caption\":\"i10X\"},\"image\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/i10x_ai\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/i10x-ai\",\"https:\\\/\\\/instagram.com\\\/i10x.ai\",\"https:\\\/\\\/www.youtube.com\\\/@i10X_ai_official\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/person\\\/d410bb7ee72febefca2c9c369939219a\",\"name\":\"Christopher Ort\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"contentUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"caption\":\"Christopher Ort\"},\"description\":\"Christopher Ort handles SEO, AI agent workflows and PR & partnerships at i10x.ai, the all-in-one AI workspace built by i10X Global Pte. Ltd. in Singapore. He is a graduate of Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU). He is the author of \u201cThe Style Penalty\u201d, a study published on SSRN that analyses 1,576 evaluation decisions by four frontier AI models to show how AI-written CVs fare in automated hiring screens; the research has been covered by heise online and t3n.\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/author\\\/christopher-ort\",\"sameAs\":[\"https:\\\/\\\/i10x.ai\\\/blog\\\/author\\\/christopher-ort\"],\"worksFor\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"alumniOf\":{\"@type\":\"EducationalOrganization\",\"name\":\"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU)\",\"url\":\"https:\\\/\\\/www.fau.eu\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"LLMjacking Surges as Hackers Target Cloud AI Bills - i10X News","description":"Threat actors hijack cloud billing accounts to run high-volume LLM inference on models like Gemini and Claude, racking up massive unauthorized costs for\u2026","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/i10xnews.kinsta.cloud\/llmjacking-cloud-billing-hijacks","og_locale":"en_US","og_type":"article","og_title":"LLMjacking Surges as Hackers Target Cloud AI Bills - i10X News","og_description":"Threat actors hijack cloud billing accounts to run high-volume LLM inference on models like Gemini and Claude, racking up massive unauthorized costs for\u2026","og_url":"https:\/\/i10xnews.kinsta.cloud\/llmjacking-cloud-billing-hijacks","og_site_name":"i10X News","article_published_time":"2026-10-31T01:39:48+00:00","og_image":[{"width":1344,"height":768,"url":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/llmjacking-cloud-billing-hijacks-title.webp","type":"image\/webp"}],"author":"Christopher Ort","twitter_card":"summary_large_image","twitter_creator":"@i10x_ai","twitter_site":"@i10x_ai","twitter_misc":{"Written by":"Christopher Ort","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"NewsArticle","@id":"https:\/\/i10xnews.kinsta.cloud\/llmjacking-cloud-billing-hijacks#article","isPartOf":{"@id":"https:\/\/i10xnews.kinsta.cloud\/llmjacking-cloud-billing-hijacks"},"author":{"name":"Christopher Ort","@id":"https:\/\/i10x.ai\/news\/#\/schema\/person\/d410bb7ee72febefca2c9c369939219a"},"headline":"LLMjacking Surges as Hackers Target Cloud AI Bills","datePublished":"2026-10-31T01:39:48+00:00","mainEntityOfPage":{"@id":"https:\/\/i10xnews.kinsta.cloud\/llmjacking-cloud-billing-hijacks"},"wordCount":696,"publisher":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"image":{"@id":"https:\/\/i10xnews.kinsta.cloud\/llmjacking-cloud-billing-hijacks#primaryimage"},"thumbnailUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/llmjacking-cloud-billing-hijacks-title.webp","articleSection":["Policy &amp; Safety","Security &amp; Defense"],"inLanguage":"en-US","dateModified":"2026-10-31T01:39:48+00:00"},{"@type":"WebPage","@id":"https:\/\/i10xnews.kinsta.cloud\/llmjacking-cloud-billing-hijacks","url":"https:\/\/i10xnews.kinsta.cloud\/llmjacking-cloud-billing-hijacks","name":"LLMjacking Surges as Hackers Target Cloud AI Bills - i10X News","isPartOf":{"@id":"https:\/\/i10x.ai\/news\/#website"},"primaryImageOfPage":{"@id":"https:\/\/i10xnews.kinsta.cloud\/llmjacking-cloud-billing-hijacks#primaryimage"},"image":{"@id":"https:\/\/i10xnews.kinsta.cloud\/llmjacking-cloud-billing-hijacks#primaryimage"},"thumbnailUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/llmjacking-cloud-billing-hijacks-title.webp","datePublished":"2026-10-31T01:39:48+00:00","description":"Threat actors hijack cloud billing accounts to run high-volume LLM inference on models like Gemini and Claude, racking up massive unauthorized costs for\u2026","breadcrumb":{"@id":"https:\/\/i10xnews.kinsta.cloud\/llmjacking-cloud-billing-hijacks#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/i10xnews.kinsta.cloud\/llmjacking-cloud-billing-hijacks"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10xnews.kinsta.cloud\/llmjacking-cloud-billing-hijacks#primaryimage","url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/llmjacking-cloud-billing-hijacks-title.webp","contentUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/llmjacking-cloud-billing-hijacks-title.webp","width":1344,"height":768,"caption":"Illustration: i10X"},{"@type":"BreadcrumbList","@id":"https:\/\/i10xnews.kinsta.cloud\/llmjacking-cloud-billing-hijacks#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/i10x.ai\/news"},{"@type":"ListItem","position":2,"name":"LLMjacking Surges as Hackers Target Cloud AI Bills"}]},{"@type":"WebSite","@id":"https:\/\/i10x.ai\/news\/#website","url":"https:\/\/i10x.ai\/news","name":"i10X News","description":"Stay updated with the latest news and announcements from i10X.","publisher":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/i10x.ai\/news?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/i10x.ai\/news\/#organization","name":"i10X","url":"https:\/\/i10x.ai\/news\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10x.ai\/news\/#\/schema\/logo\/image\/","url":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/i10x-logo-180.png","contentUrl":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/i10x-logo-180.png","width":180,"height":180,"caption":"i10X"},"image":{"@id":"https:\/\/i10x.ai\/news\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/i10x_ai","https:\/\/www.linkedin.com\/company\/i10x-ai","https:\/\/instagram.com\/i10x.ai","https:\/\/www.youtube.com\/@i10X_ai_official"]},{"@type":"Person","@id":"https:\/\/i10x.ai\/news\/#\/schema\/person\/d410bb7ee72febefca2c9c369939219a","name":"Christopher Ort","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","contentUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","caption":"Christopher Ort"},"description":"Christopher Ort handles SEO, AI agent workflows and PR & partnerships at i10x.ai, the all-in-one AI workspace built by i10X Global Pte. Ltd. in Singapore. He is a graduate of Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU). He is the author of \u201cThe Style Penalty\u201d, a study published on SSRN that analyses 1,576 evaluation decisions by four frontier AI models to show how AI-written CVs fare in automated hiring screens; the research has been covered by heise online and t3n.","url":"https:\/\/i10x.ai\/news\/author\/christopher-ort","sameAs":["https:\/\/i10x.ai\/blog\/author\/christopher-ort"],"worksFor":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"alumniOf":{"@type":"EducationalOrganization","name":"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU)","url":"https:\/\/www.fau.eu"}}]}},"_links":{"self":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/6809","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/comments?post=6809"}],"version-history":[{"count":0,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/6809\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/media\/6808"}],"wp:attachment":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/media?parent=6809"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/categories?post=6809"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/tags?post=6809"},{"taxonomy":"company","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/companies?post=6809"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/products?post=6809"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}