--- title: "Stolen AI keys ran up US$1 million bills; one reseller sold ‘unlimited’ for US$60 a month" summary: "What Google’s Mandiant found in its 2026 LLMjacking cases, published 3 November: how stolen cloud and AI keys are tested, resold and billed, and the settings that cap the damage." url: https://www.thetechbag.com/blog/stolen-ai-keys-1-million-bills-llmjacking format: Note desk: "Security" area: "Identity & access" region: Global published: 2026-11-04 facts_checked: 2026-11-04 author: TechBag (The TechBag Journal) tags: ["LLMjacking","Mandiant","Google Threat Intelligence Group","API keys","cloud credentials","Amazon Bedrock","Gemini API","LiteLLM","CVE-2026-40217","CISA KEV","spend caps","AWS Budgets","MFA","CERT-In"] cover: https://www.thetechbag.com/blog/covers/stolen-ai-keys-1-million-bills-llmjacking.png --- # Stolen AI keys ran up US$1 million bills; one reseller sold ‘unlimited’ for US$60 a month *What Google’s Mandiant found in its 2026 LLMjacking cases, published 3 November: how stolen cloud and AI keys are tested, resold and billed, and the settings that cap the damage.* Note · Security · Identity & access · By TechBag · Published 2026-11-04 · Facts checked 2026-11-04 · Canonical: https://www.thetechbag.com/blog/stolen-ai-keys-1-million-bills-llmjacking Attackers using stolen cloud and AI keys ran up more than US$100,000 of charges in a single day at some organisations, and as much as US$1 million before their access was cut, Google’s Mandiant reported on 3 November. It calls the practice LLMjacking: running large language models on someone else’s account. Mandiant handled several such cases in 2026, at financial services, retail, technology and transport companies in North America, South America and Asia Pacific.[1] 500,000 AI model calls one attacker made in under eight hours The keys fed a resale service, Jet Night, that passed “nearly one million dollars in token costs” to one victim.[1] ## From a leaked key to someone else's bill **Figure: A stolen key is tested with one-token calls, pooled with others and resold; the owner pays for every token** *How LLMjacking worked in Mandiant's 2026 incident responses, step by step* 1. 01Get a keyMostly stolen cloud credentials: IAM keys, Service Account keys, GitHub tokens, live session tokens. Also AI keys left in public GitHub code. 2. 02Test it quietlyCalls asking for one token (`max_tokens=1`) confirm a key works while staying under volume alerts. 3. 03Pool and resell“LLM Mixers” pool stolen keys behind gateways, meter use and sell access. Jet Night: “unlimited” for about US$60 a month. 4. 04The owner paysOver US$100,000 in a day in some cases; up to US$1 million before access was revoked. Source: Google Threat Intelligence Group and Mandiant, 3 November 2026 · as of 4 November 2026 One group, UNC6993, got in through a misconfigured Service Account key, then ran a fake portal that asked users to paste a raw access token, which got it past password and MFA. It tried to create more API keys and switch on AI services, and ran up over US$100,000. Another beat rate limits by creating and deleting short-lived service accounts in a loop, while watching the victim’s billing page. In several cases the AI services “were not enabled at the time of compromise”: the attackers turned them on. Google’s analysts expect LLMjacking to be favoured increasingly over cryptojacking, because resale pays at once.[1] On AWS that step is no longer needed: since 15 October 2025 every serverless Bedrock model is available by default (Anthropic’s after a one-time form), and administrators restrict access with IAM and service control policies.[2] TechBag countTechBag arithmetic 500,000 calls in under eight hours is over 1,000 a minute. Jet Night’s US$60 is 24% to 60% of the US$100 to US$250 a month that Mandiant says the same service level usually costs; Mandiant believes stolen keys are what make it profitable. ## What caps the damage From Mandiant’s list and the clouds’ own documentation:[1] - **Deny the models you do not use.** Least privilege, including access to cloud AI services; scope each key to named models, one environment and a usage limit. - **A cap, not an alert.** A default Google Cloud budget “doesn’t automatically cap” spending. A spend cap budget pauses the Gemini API or Agent Platform in one project, but enforcement “isn’t instant”.[3] AWS Budgets updates up to three times a day, typically 8 to 12 hours apart; at US$100,000 a day, that gap is US$33,000 to US$50,000 (our arithmetic).[4] - **Rotate and scan.** Keys in a secrets manager with automatic rotation; secret scanning on every repository. - **Phishing-resistant MFA** on every cloud console and developer platform. - **Log the model calls.** On AWS, Mandiant names the CloudTrail events to watch: `InvokeModel`, `Converse`, and any change to model-invocation logging. Google Cloud’s Agent Platform calls sit in Data Access logs, “disabled by default”. Alert on one-token pings, new service accounts and keys, and anyone switching logging off. Patch the gateway too. Mandiant says a second group, given keys the first had already tested, used a LiteLLM gateway flaw, “a user ID rebind vulnerability in the /key/regenerate endpoint (CVE-2026-40217)”, to turn ordinary keys into full administrator keys.[1] LiteLLM’s own advisory for that number describes a different flaw: an escape from the custom-code guardrail’s sandbox that needs an administrator credential.[5] CISA’s exploited list already holds three other LiteLLM flaws, added on 8 May, 8 June and 2 September.[6] In India, a hijacked AI account is a six-hour report Mandiant names no Indian victim. CERT-In’s Directions of 28 April 2022 list attacks on “Cloud computing” systems and on “Artificial Intelligence and Machine Learning” systems among incidents a company must report within 6 hours of noticing.[7] How we did this Figures as of 4 November 2026, 7pm IST Case figures are Mandiant’s, from incidents it handled; it does not say how many. KEV dates are from CISA’s feed (version 2026.11.03). We could not match Google’s CVE-2026-40217 description to any published LiteLLM advisory. How AI use is metered is in [our piece on agent billing](https://www.thetechbag.com/blog/how-ai-agents-are-billed-credits-actions). Spotted an error? Write to us; corrections are published at the foot of the piece. Sources 1. [Google Threat Intelligence Group and Mandiant, The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources](https://cloud.google.com/blog/topics/threat-intelligence/llmjacking-monetizing-compromised-cloud-models) — 3 November 2026 2. [AWS, Amazon Bedrock simplifies access with automatic enablement of serverless foundation models](https://aws.amazon.com/about-aws/whats-new/2025/10/amazon-bedrock-automatic-enablement-serverless-foundation-models) — 15 October 2025 3. [Google Cloud, Manage spend cap budgets](https://cloud.google.com/billing/docs/how-to/budgets-spend-caps) — 26 October 2026 Alerts-only budgets: cloud.google.com/billing/docs/how-to/budgets, same date. 4. [AWS, Managing your costs with AWS Budgets](https://docs.aws.amazon.com/cost-management/latest/userguide/budgets-managing-costs.html) — read 4 November 2026 5. [LiteLLM, advisory GHSA-wxxx-gvqv-xp7p (CVE-2026-40217)](https://github.com/BerriAI/litellm/security/advisories/GHSA-wxxx-gvqv-xp7p) — 7 May 2026 6. [CISA, Known Exploited Vulnerabilities catalogue, JSON feed](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) — 3 November 2026 7. [CERT-In, Directions under section 70B(6) of the IT Act, 2000 (Annexure I, items xviii and xx)](https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf) — 28 April 2022 **Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view. **Read this next:** [The phone call that beat MFA: how ShinyHunters got into Salesforce through OAuth](https://www.thetechbag.com/blog/shinyhunters-salesforce-oauth-phone-call) — Another way stolen tokens beat MFA: voice calls, approved apps and stolen integration tokens behind a year of Salesforce data thefts. Go deeper on TechBag - [HashiCorp Vault](https://www.thetechbag.com/hashicorp/hashicorp-vault) — central secrets storage with rotation and audit logging, the first control on Mandiant's list - [Cloud workload security guide](https://www.thetechbag.com/browse/security/cloud-workload-security) — posture tools that find exposed keys, open AI endpoints and over-broad service accounts - [Google Security Operations](https://www.thetechbag.com/google/google-security-operations) — the SIEM whose rule packs carry the detections Mandiant names