LLMjacking: The AWS, Google Cloud and Azure settings that cap stolen AI keys

Google's threat team reports that attackers using stolen cloud and AI keys ran up over $100,000 in a day, and up to $1 million, on victims' model bills, entering mainly via stolen IAM credentials, service account keys and GitHub tokens, plus leaked AI keys, open Ollama servers and a LiteLLM bug. The piece converts that advice into exact settings for AWS, Google Cloud and Azure, noting that Bedrock invocation logging and Google's Data Access logs are off by default, that budget alerts do not stop spend, and that tokens-per-minute quotas are the only ceiling that works in minutes. It also finds that the LiteLLM CVE number cited by GTIG is publicly listed as a different bug, and that no public advisory covers the /key/regenerate flaw.