All stories
Mandiant's November 2026 LLMJacking report Debates Developing

Stolen AI access ran up million-dollar bills, Google investigators report

Mandiant and Google Threat Intelligence Group describe criminals turning stolen cloud credentials and model API keys into resale services, passing large inference charges to enterprise victims.

By AITrending3 min read
Sources (2)

Why now Google's original English report was published November 2, 2026 and surfaced in a November 3 Hacker News discussion. It describes investigations across 2026; the discussion date is not the date the intrusions began.
Google investigators' API request chart shows an LLMJacking surge, separating successful calls in blue from rate-limit and quota responses in orange and other errors.
Figure 1 in GTIG and Mandiant's November 2 report. The investigators' chart illustrates API request volume; its orange peak represents rate-limit or quota responses, not successful calls or an independently audited dollar loss. Source: Google Threat Intelligence Group / Mandiant

Criminals are selling access to AI models while leaving the inference bill with compromised companies, according to a new Google threat-intelligence report. Mandiant says its 2026 investigations found fraudulent cloud charges exceeding $100,000 in a single day, with cumulative charges at some organizations reaching $1 million before access was revoked.

The November 2 report calls the activity LLMJacking. Google Threat Intelligence Group describes a division of labor between actors who obtain access and operators who aggregate and resell it through illicit gateways it calls LLM mixers. The accounts of the intrusions, billing amounts and operator behavior are the investigators’ findings and assessments; AITrending has not independently audited the victims’ bills.

Enterprise access becomes a resale supply chain

The report says exposed or stolen cloud identities were the dominant entry route across its investigations. Those included service-account keys, cloud credentials, repository tokens and active sessions. In other cases, attackers harvested exposed model API keys or found publicly reachable model endpoints.

Compromise could expand beyond an existing AI application’s quota. Mandiant says some victims had not enabled the relevant model services before intrusion: attackers used stolen permissions to enable them, create additional access and generate large bills. This makes the report relevant to organizations with broad cloud identities even if their own production AI usage is modest.

One operation made more than 500,000 model API calls in under eight hours, the report says. GTIG associates stolen third-party keys with the Jet Night routing service and says it passed nearly $1 million in token costs to the affected organization. The investigators assess that the service’s unusually cheap plans depend on stolen access. The public report does not name that victim, and the assessment should not be mistaken for a separately adjudicated finding.

Cheap tokens can hide an expensive upstream bill

GTIG describes proxy software pooling credentials and routing requests across accounts, separating the buyer’s low subscription price from the enterprise paying for upstream inference. The report also describes compromised infrastructure used to host agentic workloads. It does not say that every low-priced AI reseller uses stolen resources or that ordinary use of an open-source model gateway establishes abuse.

For defenders, the report emphasizes narrow identity permissions, centralized secret management, code scanning and model-specific quotas and spending caps. It also recommends watching for unauthorized service enablement and changes to cloud access or logging. Those controls address different parts of the chain: a billing alert alone does not revoke a stolen credential or remove persistence.

The November 3 Hacker News thread raises the question of default budget limits, but its commenters’ claims about provider behavior are not evidence for the incident totals. The underlying news is the investigators’ description of an emerging resale business with identifiable enterprise billing consequences, rather than a new model release or proof that one provider’s customers account for every case.

Related reading