Mandiant has investigated several incidents this year in which attackers took over a company’s AI account with a stolen key and ran up the bill, a practice Google Threat Intelligence Group (GTIG) calls LLMjacking.
GTIG’s Nov. 2 research covered victims in North America, South America and Asia Pacific, across financial services, retail, technology and transportation, and several different cloud and AI providers.
The money goes fast. In some incidents, fraudulent charges topped $100,000 in a single day, GTIG said, and cumulative charges reached $1 million before access was cut off.
How the Attackers Got In
The most common starting point, GTIG found, was cloud credentials that had been exposed or stolen: service account keys, GitHub personal access tokens and session tokens. Some attackers picked AI API keys straight out of public GitHub repositories, while others found AI endpoints left open to the internet.
One group GTIG tracks as UNC6993 set up a fake application portal and tricked users into handing over live access tokens, which got it past passwords and multifactor authentication (MFA). Before using a stolen key, attackers checked it worked with requests small enough not to trip an alert.
Once inside, attackers created backdoor service accounts, abused permissions that let them mint new tokens and switched on AI services the victim had never used. In one case, they exploited CVE-2026-40217 in the LiteLLM AI gateway, a tool that has had serious security gaps before, to turn ordinary keys into admin credentials.
The report also mentioned the resale market. GTIG described “LLM Mixers,” services that sell stolen AI access to subscribers. One ran more than 500,000 API calls in under eight hours and left a single victim with nearly $1 million in costs. Its prices were low enough, GTIG said, to suggest it ran on stolen keys.
What Google Recommends
Much of GTIG’s advice is about the keys themselves: keep them in a central secrets manager, rotate them automatically, scan code repositories for leaks and limit each key to the models and environments it actually needs.
It also recommended quotas, rate limits and spending caps, phishing-resistant MFA, protection for session tokens and quick patching of gateways like LiteLLM.
On the AI services, GTIG recommended blocking them by default unless a team needs them, and treating one being switched on unexpectedly as a critical alert. It also flagged data-access audit logging, which it said is turned off by default on Google Cloud.
The company said it expects attackers to choose LLMjacking over cryptojacking more and more, since it pays faster and at higher margins.
