Hackers are increasingly exploiting enterprise AI setups to generate massive cloud costs—a surge in attacks known as LLMJacking has left several organizations grappling with bills in the millions. These intrusions, investigated by Mandiant and reported in November 2026, show how quickly compromised access to large language models can turn into a major financial liability. One case alone saw over $1 million charged to a single company in under a day.
What is LLMJacking and How It Works
Unlike crypto-mining, these attacks leverage stolen AI access credentials—service account keys, personal access tokens from code hosting platforms, or session tokens—to run large numbers of model API calls. In many instances, attackers probe for valid keys by sending tiny requests, such as using an AI parameter like max_tokens=1, which avoids triggering alerts. Once access is confirmed, they scale up the abuse.
One particularly sophisticated group, tagged UNC6993, found a misconfigured service account key that reached core cloud infrastructure. They also used a sham membership portal to trick users into pasting active session tokens—bypassing two-factor and password checks altogether. Attackers often search public code repositories, secret managers, and other internal storage for exposed credentials. In one notable breach, a flaw in LiteLLM (CVE-2026-40217) allowed attackers to elevate privileges and establish long-term control through newly generated virtual keys.
The Business of Reselling Stolen Access
Reports suggest attackers are building service ecosystems around stolen credentials. Some specialize in infiltrating environments; others run what are called “LLM mixers”—platforms that aggregate stolen access and resell it to end customers. Victims don’t just lose data—they absorb the financial fallout.
In one case, over half a million API calls were made in under eight hours via stolen third-party keys. Billing for that activity reached nearly one million dollars, while attackers pocketed profits by routing stolen access to subscribers. The attack spread across sectors including financial services, retail, tech, and transportation throughout the Americas and the Asia-Pacific region.
Prevention Strategies: What Organizations Must Do
Security teams are being urged to treat any activation of AI services—especially when not in active use—as a red flag. Key indicators include sudden new access key creation, unusual patterns of model requests (even small ones), unusual user account behavior, and attempts to silence logging or monitoring services. It’s not enough to react to spikes in billing; validation requests and light probe traffic need scrutiny too.
Mitigation measures include rotating all exposed secrets, restricting permissions on service accounts, scanning public repositories and internal storage for leaked keys, patching known vulnerabilities in AI gateways, and enforcing strict quotas per model or user. Also, revoking one compromised key won’t fully resolve the breach if attackers have already planted backdoor accounts.
These types of attacks highlight how identity and credential security are becoming key battlegrounds in the AI era. With major financial exposure tied to LLM access, defenders must shift from reactive to proactive strategies—treating AI service anomalies as early warning signs and building infrastructure that assumes credentials are at risk. The cost of oversight isn’t just data loss anymore—it can register as a cloud bill that sinks the budget.
