Criminals using stolen cloud credentials have run up fraudulent bills for AI model use that topped $100,000 in a single day in some incidents and reached up to $1 million at some organizations before access was cut off, according to vendor research from Google's Mandiant incident responders and Google Threat Intelligence Group reported by The Register Monday. The findings make leaked keys and unused AI services a direct financial exposure for finance chiefs and security leaders alike.
What Happened
Google calls the activity "LLMjacking": hijacking an organization's access to large language models (LLMs), the paid AI systems behind chatbots and coding tools, then using or reselling that access at the victim's expense. Google said victims, whom it did not name, were in financial services, retail, technology and transportation across three continents.
The main way in, according to Google, was exposed or stolen cloud identity material: access credentials, service account keys used by software, GitHub personal access tokens, live session tokens and AI keys left in public code repositories. A group Google tracks as UNC6993 entered through a misconfigured service account key and ran a fake portal that tricked users into pasting live access tokens, sidestepping passwords and multifactor authentication (MFA). It then created new keys, switched on AI services and ran up more than $100,000 in charges, Google said.
In another case, an intruder using a resale service called Jet Night made more than 500,000 model requests in under eight hours, passing nearly $1 million in costs to one victim. Jet Night advertised unlimited access for about $60 a month, against a typical $100 to $250, a price Google says suggests stolen keys.
Google describes a division of labor: some crews break in while others, which it calls "LLM mixers," pool and resell the access. Attackers tested stolen keys with requests capped at a one-token reply to stay under volume alerts and often enabled AI services victims had never used. One cluster exploited a flaw in LiteLLM, an open-source gateway that routes requests to AI providers, tracked as CVE-2026-40217, to turn ordinary keys into administrator credentials. In several incidents, attackers switched on services such as Amazon Bedrock and Google's Gemini API, Google said.
Why It Matters
Metered AI access can produce large bills within hours, unlike cryptojacking, the theft of computing power to mine digital currency, which drains resources gradually. Google expects criminals to increasingly favor LLMjacking for that reason. John Hultquist, chief analyst at Google Threat Intelligence Group, said in comments reported by The Register that locking down these resources also shields the wider community from "a deluge of cheap, autonomous attacks."
Google recommends treating any unauthorized enabling of AI services as a critical security event, denying AI services by default, limiting keys by model and environment, setting quotas and spending caps, rotating secrets centrally, requiring phishing-resistant MFA and scanning code for leaked keys.
Context
The Primary Wire reported Oct. 31, citing BleepingComputer, that customers of the cloud platform Northflank saw stored AI keys abused, and reported in September, citing SecurityWeek, on a Windows botnet sold with a mode for draining victims' paid AI credits. LiteLLM separately suffered a poisoned software release in October that the project traced to a leaked master key, The Primary Wire reported, citing The Record.
What to Watch
Google expects attackers to automate searches for exposed tokens and keep probing AI gateways. Open questions include how cloud providers handle disputed charges and whether they make spending caps or disabled AI services the default for new projects. Companies running LiteLLM should confirm they have patched CVE-2026-40217.
