LLMJacking: Google researchers report stolen AI access bills up to $1 million

What happened

Help Net Security reports on research from Google Threat Intelligence Group (GTIG) and Mandiant. The researchers say criminals who break into corporate cloud accounts use that access to run AI models at the victim’s expense. They call this “LLMJacking.” According to the report, some incidents generated more than $100,000 in charges in a single day. In some attacks, bills reached up to $1 million before the attackers lost access.

Help Net Security says Mandiant responded to several of these incidents in 2026. The victims were in the financial services, retail, technology and transportation sectors in North America, South America and Asia Pacific. The victim organizations are not named, and the source does not include any independent verification beyond the researchers’ findings.

Other points from the report, as described by GTIG and Mandiant via Help Net Security:

• Resale market: GTIG describes a division of labor. One group breaks into environments, and another runs “LLM Mixers” that resell stolen AI access. One such service, Jet Night, offers an unlimited plan for about $60 a month. A threat actor feeding it stolen keys reportedly made more than 500,000 model calls in under eight hours, leaving one victim with nearly a million dollars in token costs.
• Lookalike domain: In another case, an attacker reportedly registered a lookalike domain posing as a victim’s internal host. The attacker used it to funnel the company’s AI access to a resale operation called newapi.pro.
• Entry points: GTIG says the attackers target publicly exposed LLM endpoints or obtain valid LLM API keys. One group harvested keys from public GitHub repositories and tested them with requests too small to trip alerts. The researchers say the most common entry point was a stolen cloud credential, such as a service account key, a GitHub access token or an active session token.
• UNC6993: This group reportedly used a misconfigured service account key to reach an AI API. It also ran a fake portal that tricked visitors into pasting data containing an active access token, which bypassed passwords and MFA.
• After access: Attackers reportedly searched code repositories, databases and data warehouse tables for more credentials. They also performed cloud storage operations tied to data theft and created backdoor accounts, one disguised as an internal billing optimization tool.
• LiteLLM flaw: In one case, an attacker reportedly exploited CVE-2026-40217 in a LiteLLM gateway to turn ordinary access keys into administrator credentials. The NVD record retrieved for this advisory contained no details. Affected and fixed LiteLLM versions are not confirmed.
• Services switched on: Mandiant says that in several incidents, the AI services were switched off at the time of compromise. The attackers used stolen access keys to turn them on.

Am I affected?

You may be exposed if any of the following apply:

• Your cloud accounts can enable or call AI model APIs.
• Your AI API keys, service account keys, GitHub tokens or session tokens could have been exposed, for example in public GitHub repositories.
• You run a LiteLLM gateway. Whether your version is affected by CVE-2026-40217 is not confirmed by the sources.

Signs described in the report include:

• Sudden spikes in API requests or token charges.
• AI services being enabled without your approval.
• Unfamiliar accounts, such as one presented as a billing optimization tool.
• Domains that imitate your internal hosts.

What to do now

1. Monitor and alert on changes to AI accounts and services, including services being switched on. Mandiant names this as the starting point for defenders, according to Help Net Security.
2. Review recent AI usage and billing for unexplained spikes in requests or token costs.
3. Revoke and rotate any AI API keys, service account keys, GitHub tokens or session tokens you suspect are exposed. Check public repositories for committed keys.
4. Review service account configuration, since the report cites a misconfigured service account key as one entry point.
5. Audit for unexpected new accounts and for lookalike domains imitating your internal hosts.
6. If you run LiteLLM, check the NVD record for CVE-2026-40217 and your vendor channels for fixed versions. These are not confirmed in the sources.

Sources

• Help Net Security: Stolen AI access leaves companies with cloud bills of up to $1 million
• NVD: CVE-2026-40217