Google Threat Intelligence Group and Mandiant report that criminals are stealing cloud credentials to run AI models on other organizations’ accounts, then reselling the capacity at a discount. One reseller, Jet Night, advertised an unlimited plan for about $60 a month, against the $100 to $250 that a comparable consumer tier typically costs. At some victims, stolen usage reached roughly $1 million in charges before access was cut off.
Tech news in one quick read: Get the most interesting stories in startups, tech and programming, each with a short TLDR, in one daily email from TLDR.
We may earn a commission if you sign up.
The practice is called LLMjacking, and the research published on Nov. 2 treats it as the successor to cryptojacking. Cryptojacking drains computing power slowly. Hijacked language-model access can pile up fraudulent charges within hours, so a victim often learns about the theft from an invoice rather than from a slowdown.
In the Google report on LLMjacking, authors including Christopher Romano, Codi Starks and Garrett Mahoney say Mandiant responded to several incidents in 2026 across financial services, retail, technology and transportation, in North America, South America and Asia Pacific. One incident topped $100,000 in a single day, and cumulative charges at some organizations reached $1 million before access was revoked.
Jet Night and the economics of an unlimited plan
The report’s clearest case involves one actor who made more than 500,000 model calls in under eight hours using stolen third-party API keys to feed Jet Night’s token-routing service. Nearly $1 million in token costs landed on the victim organization. Google’s analysts believe a service priced at $60 for unlimited use can only turn a profit if its keys are stolen, and they read Jet Night’s advertised outages on Telegram as signs that victims were revoking those keys.
A second reseller, newapi.pro, was fed through a lookalike domain that imitated one of a victim’s internal hosts, draining that victim’s quotas to serve paying customers, as Help Net Security’s summary of the research explains. The researchers describe a division of labor in which initial-access actors break into environments and hand off the keys to so-called LLM Mixers, who proxy, aggregate and resell the access to underground subscribers.
From a leaked service account key to a LiteLLM administrator
Front-end chatbots are not the target. The dominant entry point in the cases Mandiant handled was an exposed or stolen cloud identity token: a service account key, a GitHub access token or an active session token. One group harvested API keys from public GitHub repositories and tested each with a request capped at one token, a low-volume probe meant to stay under alerting thresholds. A cluster tracked as UNC6993 ran a fake portal for joining an LLM user group, where visitors pasted data containing a live access token, which let the attackers sidestep passwords and multi-factor checks.
Gateways add another route. Google says one actor exploited CVE-2026-40217 in a LiteLLM gateway’s key-regeneration endpoint to turn ordinary virtual keys into administrator credentials. The public National Vulnerability Database record for that identifier describes something different, a remote code execution bug in a guardrails test endpoint, published April 10 with a severity score of 8.8. The mismatch leaves the exact flaw behind that escalation unclear.
Once inside, the intruders did more than run models. They searched code repositories and databases for further credentials, and in one intrusion they queried data warehouse tables for database credentials, administrator passwords and sensitive columns while performing cloud storage operations tied to data theft. Backdoor accounts were also created, one disguised as an internal billing optimization tool, a name chosen to survive a casual review of the account list.
Controls Mandiant recommends, and the limit of billing alerts
Mandiant’s advice centers on shrinking what a stolen key can do. It calls for centralized secrets management with automated rotation, least-privilege policies that deny LLM permissions not explicitly needed, phishing-resistant multi-factor authentication, and keys scoped by model, environment and usage limit. It also recommends spending caps and per-model quotas, and treats any unauthorized enablement of an LLM service as a critical security event, because in several incidents the AI services had been switched off until attackers turned them on with stolen credentials.
Budget tools need careful reading. Google Cloud’s own billing budget documentation says an alerts-only budget does not automatically cap usage or spending, so an email at a threshold arrives while the meter keeps running. The pattern first drew attention in Sysdig’s May 2024 research, which estimated a worst case above $46,000 a day for one assumed quota. The 2026 figures for a single day, above $100,000, are more than double that estimate.
Detection guidance in the report is specific. Defenders are told to watch gateway logs for low-volume validation sweeps, such as requests capped at one token or zero-temperature pings, and to inspect User-Agent strings for automated tools and SDKs including claude-cli, aws-sdk-rust and aws-sdk-go-v2. On AWS, calls to the Bedrock invocation APIs, to model-listing operations and to the logging-configuration settings deserve alerts; on Google Cloud, Data Access logs must be enabled manually because they are off by default; on Azure, writes to cognitive-services deployments are the signal.
Google’s researchers expect the trade to grow, since resale lets criminals profit quickly while victims pay. They warned that cybercriminals will likely refine automated reconnaissance to target exposed API tokens. No count of affected organizations has been published.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
Tech news in one quick read: Subscribe to TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- Two passengers died at an Ohio toll plaza, and the NTSB now wants the cash lanes shut
- Long use of a common prostate pill is tied to a higher chance of glaucoma
- Ford is recalling 223,472 F-150 pickups because the fuel tank can leak or detach
- Hybrids have 15% fewer problems than gas cars, while EVs and plug-in hybrids have about 80% more, Consumer Reports finds
