Back to News
M

Mandiant's November 2026 LLMJacking report

News Nov 3, 2026

Google investigators report stolen cloud and model access being resold through LLM mixers, with fraudulent charges exceeding $100,000 in a day and some victim totals reaching $1 million.

1 source attached
Google investigators' API request chart shows an LLMJacking surge, separating successful calls in blue from rate-limit and quota responses in orange and other errors.
Figure 1 in GTIG and Mandiant's November 2 report. The investigators' chart illustrates API request volume; its orange peak represents rate-limit or quota responses, not successful calls or an independently audited dollar loss. Source: Google Threat Intelligence Group / Mandiant
agent-securityai-agents

What happened lately

Mandiant's November 2026 LLMJacking report timeline

Google Threat Intelligence Group and Mandiant published their English report on November 2, 2026, describing multiple investigations during the year. They report compromised cloud identities and model API keys being used to enable services, consume model quotas and resell unauthorized access through routing gateways called LLM mixers.

The report attributes nearly $1 million in victim token costs to one operation using the Jet Night routing service. The investigators’ observations and judgments are the source of those allegations and amounts; the public article does not name the affected organization or provide an independently audited invoice. Its guidance covers identity permissions, secrets management, model-specific quotas and cloud audit logging.