Mandiant and Google Threat Intelligence Group (GTIG), part of Google, published a report on November 2, 2026, on "LLMJacking," in which attackers use stolen cloud credentials and API keys to run large language models (LLMs) at victims' expense. According to Mandiant, in individual incidents it handled in 2026, fraudulent charges exceeded $100,000 per day, and at some organizations the cumulative total reached $1 million before the attackers' access was cut off. The $100,000-a-day figure matches the level that security firm Sysdig estimated in 2024 as the potential cost of abusing cutting-edge AI models.
However, the amounts Mandiant cited were observed in actual incidents and are not averages across victim organizations. The number of incidents covered and the method used to calculate the amounts have not been disclosed. What matters in this report is that high charges once considered worst-case scenarios two years ago have now been confirmed in practice, and that attackers were found enabling LLM services that were unavailable at the time of compromise, then running large volumes of inference in a short time.
"$100,000+ a day" is an amount observed in individual incidents, not an average
Mandiant said that in individual incidents, fraudulent charges from resource consumption exceeded $100,000 in a single day. At some organizations, it said, cumulative charges reached $1 million before the attackers' access was revoked. Both are amounts from cases confirmed during investigations. They do not represent a level common to all victims or a typical loss.
Key details about the figures remain undisclosed. It is not stated how many incidents were investigated, how many of them exceeded $100,000 in a day, which dates or measurement periods were covered, or whether the charges were finalized amounts or estimates. The victims span North America, South America, and Asia-Pacific, in industries including financial services, retail, technology, and transportation. However, the specific Asia-Pacific countries are not named, and it is not clear whether any Japanese companies are among the victims.
The high fraudulent charges also drew attention in overseas media. SiliconANGLE reported that Google had identified attacks leading to $100,000-a-day fraudulent cloud bills, and The Register covered attacks that left companies with LLM usage charges of more than $100,000 a day. But these amounts do not mean victims are paying that much every day on an ongoing basis. What Mandiant's primary report shows is the daily charge observed in individual incidents.
The report also includes a separate case involving charges of more than $100,000. The threat group Mandiant tracks as "UNC6993" used stolen credentials to create additional API keys and attempted to enable related LLM services. As a result, charges exceeding $100,000 accumulated in a short period. The exact timeframe for this case is not specified, and it is not stated to be the same incident as the "$100,000+ a day" case above, so the two should be kept distinct.
The reason charges can balloon so quickly lies in the pay-as-you-go pricing of LLMs. Traditional cryptojacking uses stolen computing resources to mine cryptocurrency, so resource consumption builds relatively slowly. With LLMJacking, by contrast, attackers choose expensive AI models and continuously send large numbers of API requests, so inference charges can pile up rapidly. Mandiant warns that such abuse can cause cloud bills to spike within hours.
Sysdig's 2024 estimate has become real-world damage in 2026
The name "LLMjacking" was first used by Sysdig's threat research team in a report published on May 6, 2024. At the time, Sysdig had identified attacks that used cloud credentials stolen by exploiting a vulnerable Laravel installation (CVE-2021-3129) to target 10 different cloud LLM services. The attackers used the illicitly obtained credentials to probe their access to LLMs and attempted to sell that access to third parties.
In that research, Sysdig estimated that if Anthropic's Claude 2.x were used up to its quota limits across multiple regions, victims could face charges of more than $46,000 per day. This was not an actual billed amount but a worst-case calculation based on the model pricing and quotas of the time. It showed that if attackers ran inference up to the available limits, they could generate high costs in a short period.
A follow-up published on September 18 of the same year reported changes in attack methods. Attackers were not only abusing LLMs that were already available but also attempting to enable the models themselves using stolen cloud credentials. Sysdig also noted that if a state-of-the-art model of the time, such as Claude 3 Opus, were abused, the potential cost to victims could exceed $100,000 per day. On July 11, 2024, Sysdig also observed roughly 61,000 requests to the AWS Bedrock API in just three hours, confirming that attackers can run huge volumes of inference in a very short time.
GTIG also addressed abuse targeting corporate cloud environments and AI accounts in its "AI Threat Tracker" on September 8, 2026. The November 2 report analyzes the reality of these attacks in more detail, drawing on Mandiant's incident response cases. The main reports on amounts are organized chronologically below.
| Published | Source | Amount per day | Nature of the figure |
|---|---|---|---|
| May 6, 2024 | Sysdig | Over $46,000 | Worst-case estimate assuming abuse of Claude 2.x |
| Sept 18, 2024 | Sysdig | Over $100,000 | Estimated potential cost of cutting-edge models such as Claude 3 Opus |
| Nov 2, 2026 | Mandiant, GTIG | Over $100,000 | Fraudulent charges observed in individual incidents |
There is an important difference between Sysdig's 2024 estimates and Mandiant's 2026 observations. The former are potential costs calculated from assumed usage volumes and pricing, while the latter are fraudulent charges confirmed during actual incident response. Because they were not measured under the same conditions, it is not possible to say that damage has increased by a certain multiple. And because Mandiant has not disclosed the number of cases or how the amounts were calculated, average damage or a rate of increase cannot be derived either.
There are both changes and continuities in attack methods since 2024. Sysdig had already confirmed the enabling of models using stolen credentials in September 2024. What Mandiant's 2026 report newly reveals is that such attacks are actually generating enormous bills, and that a division of labor is advancing between attackers who handle initial intrusion and those who resell the illicitly obtained LLM access.
Attackers enabling LLM services that were disabled
Most LLMJacking begins with the theft of cloud environment credentials. According to Mandiant, the main initial access vector across multiple investigations was exposed or stolen cloud identity tokens. These included IAM (Identity and Access Management) credentials, service account keys, GitHub personal access tokens (PATs), and valid session tokens. There were also reports of attackers calling /api/create on Ollama endpoints left accessible from outside and attempting to register their own models.
In mid-2026, UNC6993 exploited a misconfigured service account key to break into a cloud instance and used it as a foothold to expand access to LLM APIs. It also set up a page posing as a portal for joining an LLM user group and had users paste JSON data containing valid access tokens for a legitimate LLM service. With tokens obtained this way, attackers can abuse authenticated sessions without having to enter passwords or multi-factor authentication (MFA) again. It is a case showing that even where MFA is deployed, stolen post-authentication tokens can allow unauthorized access.
Attackers also took steps to avoid detection when checking whether stolen API keys were still valid. One group collected corporate LLM API keys from public GitHub repositories and automatically sent requests specifying max_tokens=1, limiting output to a single token. Even requesting just one token of output is enough to confirm whether the API responds normally. But because resource consumption per request is extremely small, such requests are easily missed by systems that detect large volumes of processing or sudden traffic spikes.
According to Mandiant, this technique was not caught by usage-based anomaly detection alerts in victims' EDR (endpoint detection and response) or SIEM (security information and event management) systems. Attackers were thus using low-load requests to sift through usable credentials before running large-scale inference. Monitoring only for abnormal access volume, as has traditionally been done, may fail to catch this preparatory stage.
More serious is that an LLM service not being enabled at the time of intrusion does not necessarily prevent an attack. In multiple cases Mandiant investigated, LLM services were disabled when the attackers got in. But if the stolen credentials carry sufficient privileges, attackers can change the configuration of services such as AWS Bedrock or the Gemini API and enable them. Mandiant explains that once a service is enabled, attackers can generate enormous charges within minutes to hours.
In fact, UNC6993 generated additional API keys within a compromised cloud project and tried to enable related services, producing charges of more than $100,000 in a short period. Another attacker enrolled a victim account in a pay-as-you-go contract, selected expensive foundation models, and ran large volumes of inference. A technique called "burn and rotate," in which short-lived service accounts are repeatedly created and deleted to evade rate limits, was also observed. This attacker reportedly examined the cloud provider's billing screens and even monitored how costs from the abuse were accruing.
Attackers abused not only LLM inference services but also cloud computing resources. In another case, they placed a container-based backdoor using the Manus agent framework in a compromised environment, building a mechanism that interprets instructions via an external LLM while executing commands. They also tried to launch instances equipped with high-performance GPUs in multiple regions and requested increases to the necessary quotas. Such cases show that LLMJacking is evolving beyond mere API abuse into theft of resources across the entire cloud environment.
"LLM Mixer": reselling access to stolen LLMs
Mandiant and GTIG also revealed that criminal activity around LLMJacking is increasingly divided by role. Attackers responsible for initial intrusion steal corporate credentials and API keys, while other attackers aggregate and resell the illicitly obtained LLM access. GTIG calls the relay infrastructure for this abuse an "LLM Mixer." In one investigation, two different attack groups worked together, dividing the work from intruding into corporate LLM infrastructure to monetizing it.
An LLM Mixer aggregates multiple stolen API keys and cloud credentials and functions as a gateway that relays requests from users. Attackers use open-source API gateways or custom relay infrastructure to distribute requests across multiple accounts while measuring usage. This lets third parties who purchase the service use models just as they would a normal LLM API, while the processing charges are billed to the companies whose credentials were stolen. The structure separates the API provider that users see from the organization that actually bears the cost.
UNC6993 used "new-api," an open-source gateway that consolidates access to multiple models, and "gcli2api," which converts command-line tools into a common LLM API format. GTIG assesses that these tools were likely used to aggregate stolen credentials and spread requests across multiple accounts. UNC6993 also appears to sell access to such relay infrastructure through underground marketplaces.
The division of labor among attackers was also confirmed in a case abusing LiteLLM. LiteLLM is software that centrally relays requests to multiple LLMs and can issue API keys called Virtual Keys to each user. According to Mandiant, one attack group handed a valid Virtual Key obtained from a victim to another group, and the subsequent attacker targeted the victim organization's LiteLLM gateway. The attacker exploited a privilege escalation vulnerability to obtain PROXY_ADMIN credentials, which carry administrator privileges, from an ordinary Virtual Key.
There is, however, a discrepancy in the vulnerability identifier in this case. Mandiant refers to a vulnerability involving user ID rebinding at the /key/regenerate endpoint as "CVE-2026-40217," but the vulnerability registered under that number in the GitHub Advisory Database concerns a sandbox escape and arbitrary code execution issue in /guardrails/test_custom_code. Meanwhile, CVE-2026-47101 is registered as a vulnerability in which LiteLLM does not properly validate allowed_routes permissions when generating API keys, allowing ordinary users to access administrator-only operations.
The description of CVE-2026-47101 is similar to Mandiant's report in terms of escalation to administrator privileges, but the affected endpoint and the attack mechanism do not match. In public information as of November 3, 2026, no CVE number can be identified that actually corresponds to the attack Mandiant reported. For this reason, it is necessary to avoid treating CVE-2026-40217, as stated in the report, as the identifier for the /key/regenerate privilege escalation.
One case showing how LLM Mixers are monetized is the token relay service "Jet Night (jet-night.com)." According to Mandiant, one attacker ran more than 500,000 LLM API requests in under eight hours, using stolen third-party API keys to power the Jet Night service. This abuse reportedly generated nearly $1 million in token usage charges for the victim organization. Because the people paying for the service are different from the organization bearing the actual processing costs, attackers can resell expensive AI services at low prices.
Jet Night advertised access to cutting-edge models and sold an unlimited-token plan for about $60 a month. According to GTIG, comparable consumer services typically cost $100 to $250 a month, so Jet Night's price was far below that. Taking the roughly $60 price as a baseline, that is about 40% cheaper than a $100-a-month service and about 76% cheaper than a $250-a-month service. However, this difference is calculated from the approximate price range GTIG gave, and the specific services used for comparison were not disclosed.
GTIG assesses that, given this large price gap, Jet Night is securing profit by using stolen API keys. It also considers it likely that outages the service repeatedly announced on Telegram were caused by victim organizations noticing the abuse and revoking the stolen API keys. For attackers, continuously securing stolen keys is a factor that determines whether the service can keep operating.
Countering bills that swell within hours: detecting service enablement is key
As defensive measures, Mandiant recommends monitoring changes to LLM accounts and service configurations and treating the enabling of unauthorized services as a critical security event. Because damage has occurred even at organizations where LLM services were disabled at the time of compromise, a service not currently in use is not necessarily safe. Given how short the time is between an attacker enabling a service and running large-scale inference, responding only after abnormal billing amounts are confirmed is not enough.
For companies using Google Cloud, audit log configuration is also important. According to Mandiant, inference operations on the Gemini Enterprise Agent Platform (aiplatform.googleapis.com) are recorded in Data Access audit logs, but these logs are disabled by default because of the large volume of data they generate and the ingestion costs. To monitor inference operations, the IAM audit policy therefore has to be configured manually. Mandiant also recommends detecting and alerting on execution of google.api.serviceusage.v1.ServiceUsage.EnableService, which enables services on the platform.
Similar monitoring is needed on AWS and Azure. For AWS, Mandiant advises using CloudTrail to monitor API operations such as Amazon Bedrock's Converse and InvokeModel. For Azure, it lists as monitoring targets not only high-volume access to model inference endpoints but also the creation of new deployments and changes to diagnostic log settings. What matters is detecting abuse from the stage when available services or credentials change, not just from LLM access volume.
For credential protection, recommended measures include centralized management of API keys and secrets, regular rotation, and automated scanning for credentials in source code. It is also important to grant users and service accounts only the minimum necessary privileges and not to give access to LLM services they do not plan to use. Even if credentials leak, limiting the range of what attackers can do, such as enabling new services or calling expensive models, helps contain the damage.
Detection should cover not only large volumes of inference requests but also small API calls specifying max_tokens=1. Because such requests are used to check whether credentials are valid, they are hard to find with alerts based only on normal usage volume. Limiting the models and usage environments each API key can access, and setting per-model quotas and spending caps, may also help hold down costs in cases of abuse. However, because a budget alert does not necessarily mean usage will be automatically stopped, it is necessary to check with each cloud provider under what conditions requests are actually blocked.
Vulnerability management for LLM relay infrastructure is also essential. API gateways such as LiteLLM centrally handle access rights and credentials for multiple models, so a compromise can spread damage easily. Mandiant calls for treating such gateways as targets of vulnerability management just like ordinary applications and for thoroughly applying patches for issues that could lead to privilege escalation or authentication bypass. A combination of credential protection, privilege restrictions, monitoring of service configurations, and control of API usage is the basis for containing damage early.
GTIG predicts that attackers will increasingly prioritize LLMJacking over traditional cryptojacking. Behind this are the ability to monetize illicitly obtained LLM access in a short time and the emergence of a resale market through LLM Mixers. John Hultquist, GTIG's chief analyst, also told The Register that tightly controlling access to such resources is important not only for protecting companies from enormous bills but also for preventing cheap autonomous attacks from spreading widely.
Mandiant's report needs to be read with care in that the figure of more than $100,000 a day is merely a level observed in individual cases and does not represent typical damage. Even so, the fact that LLM services disabled at the time of compromise can be enabled by attackers and generate enormous charges within minutes to hours is a serious risk for corporate cloud management. Companies need to put in place, before any abuse begins, mechanisms to detect the enabling of LLM services and settings that restrict API usage permissions and spending.