Stolen AI keys ran up US$1 million bills; one reseller sold ‘unlimited’ for US$60 a month
What Google’s Mandiant found in its 2026 LLMjacking cases, published 3 November: how stolen cloud and AI keys are tested, resold and billed, and the settings that cap the damage.
Attackers using stolen cloud and AI keys ran up more than US$100,000 of charges in a single day at some organisations, and as much as US$1 million before their access was cut, Google’s Mandiant reported on 3 November. It calls the practice LLMjacking: running large language models on someone else’s account. Mandiant handled several such cases in 2026, at financial services, retail, technology and transport companies in North America, South America and Asia Pacific.1
500,000
AI model calls one attacker made in under eight hours
The keys fed a resale service, Jet Night, that passed “nearly one million dollars in token costs” to one victim.1
01From a leaked key to someone else's bill
A stolen key is tested with one-token calls, pooled with others and resold; the owner pays for every token
How LLMjacking worked in Mandiant's 2026 incident responses, step by step
- 01
Get a key
Mostly stolen cloud credentials: IAM keys, Service Account keys, GitHub tokens, live session tokens. Also AI keys left in public GitHub code.
- 02
Test it quietly
Calls asking for one token (
max_tokens=1) confirm a key works while staying under volume alerts. - 03
Pool and resell
“LLM Mixers” pool stolen keys behind gateways, meter use and sell access. Jet Night: “unlimited” for about US$60 a month.
- 04
The owner pays
Over US$100,000 in a day in some cases; up to US$1 million before access was revoked.
Source: Google Threat Intelligence Group and Mandiant, 3 November 2026 · as of 4 November 2026
One group, UNC6993, got in through a misconfigured Service Account key, then ran a fake portal that asked users to paste a raw access token, which got it past password and MFA. It tried to create more API keys and switch on AI services, and ran up over US$100,000. Another beat rate limits by creating and deleting short-lived service accounts in a loop, while watching the victim’s billing page. In several cases the AI services “were not enabled at the time of compromise”: the attackers turned them on. Google’s analysts expect LLMjacking to be favoured increasingly over cryptojacking, because resale pays at once.1 On AWS that step is no longer needed: since 15 October 2025 every serverless Bedrock model is available by default (Anthropic’s after a one-time form), and administrators restrict access with IAM and service control policies.2
02What caps the damage
From Mandiant’s list and the clouds’ own documentation:1
- Deny the models you do not use. Least privilege, including access to cloud AI services; scope each key to named models, one environment and a usage limit.
- A cap, not an alert. A default Google Cloud budget “doesn’t automatically cap” spending. A spend cap budget pauses the Gemini API or Agent Platform in one project, but enforcement “isn’t instant”.3 AWS Budgets updates up to three times a day, typically 8 to 12 hours apart; at US$100,000 a day, that gap is US$33,000 to US$50,000 (our arithmetic).4
- Rotate and scan. Keys in a secrets manager with automatic rotation; secret scanning on every repository.
- Phishing-resistant MFA on every cloud console and developer platform.
- Log the model calls. On AWS, Mandiant names the CloudTrail events to watch:
InvokeModel,Converse, and any change to model-invocation logging. Google Cloud’s Agent Platform calls sit in Data Access logs, “disabled by default”. Alert on one-token pings, new service accounts and keys, and anyone switching logging off.
Patch the gateway too. Mandiant says a second group, given keys the first had already tested, used a LiteLLM gateway flaw, “a user ID rebind vulnerability in the /key/regenerate endpoint (CVE-2026-40217)”, to turn ordinary keys into full administrator keys.1 LiteLLM’s own advisory for that number describes a different flaw: an escape from the custom-code guardrail’s sandbox that needs an administrator credential.5 CISA’s exploited list already holds three other LiteLLM flaws, added on 8 May, 8 June and 2 September.6
Sources
- Google Threat Intelligence Group and Mandiant, The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources — 3 November 2026
- AWS, Amazon Bedrock simplifies access with automatic enablement of serverless foundation models — 15 October 2025
- Google Cloud, Manage spend cap budgets — 26 October 2026 Alerts-only budgets: cloud.google.com/billing/docs/how-to/budgets, same date.
- AWS, Managing your costs with AWS Budgets — read 4 November 2026
- LiteLLM, advisory GHSA-wxxx-gvqv-xp7p (CVE-2026-40217) — 7 May 2026
- CISA, Known Exploited Vulnerabilities catalogue, JSON feed — 3 November 2026
- CERT-In, Directions under section 70B(6) of the IT Act, 2000 (Annexure I, items xviii and xx) — 28 April 2022
Disclosure. TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.
Keep reading
