By Allan Juma, Lead Cybersecurity Engineer at ESET
Criminals now use stolen cloud keys to run AI models on other companies’ accounts, and the company pays the bill. Google Threat Intelligence Group and Mandiant published research on this in early November 2026. Google found single-day charges above $100,000 on some accounts, and some companies reached $1 million before access ended. The good news is that LLMJacking protection relies mostly on habits that any team can build.
Why LLMJacking Protection Matters in Kenya
Credential attacks are rising in Kenya, which makes this a local concern. The National KE-CIRT/CC detected 44,949,518 brute-force attempts between July and September 2026, an 85.41% rise from April to June. The report says attackers mainly targeted cloud providers and government systems, and it names compromised credentials and missing multifactor authentication as key weaknesses. Strong LLMJacking protection also helps with data law, since the Data Protection Act requires notice within 72 hours when personal data reaches an unauthorised person.
Simple Steps that Keep Your Cloud Bill Safe
Attackers log in with valid keys, so they blend in with normal activity. Keys leak through public code repositories, infected devices and old breach data. Good LLMJacking protection starts with a few habits that any team can build. Check code for keys before pushing it to a public repository, rotate keys regularly, and protect every login with multifactor authentication. Keep development, staging and production apart with separate keys, so one stolen key cannot open every environment.
Visibility matters just as much for LLMJacking protection, so turn on billing alerts and spending caps. Review audit logs for permission changes or unfamiliar logins, and learn what normal looks like. Treat any unexpected activation of AI services as a security event, because Google found attackers switching them on in accounts that never used them. The practical lesson for Kenyan companies is to manage cloud keys like passwords and money, with named owners, short lifespans and regular reviews.
