Mandiant reports stolen AI cloud access running up charges above $100,000 a day

Mandiant, part of Google’s threat-intelligence group, published a report on “LLMjacking”: attackers who steal a company’s cloud or AI-service credentials and use its access to commercial language models, leaving the victim with the bill. The report drew on several 2026 incident-response cases across financial services, retail, technology and transportation in North America, South America and Asia Pacific.

Mandiant said fraudulent charges at victims exceeded $100,000 in a single day, and that cumulative charges at some organisations reached $1 million before access was revoked. It contrasted this with cryptocurrency-mining abuse, saying LLMjacking “can generate large spikes in fraudulent cloud charges in a matter of hours”. In one case it described, a service called Jet Night made more than 500,000 API calls in under eight hours, passing nearly $1 million in token costs to the victim. A second actor, tracked as UNC6993, ran up over $100,000 after enabling extra services.

The report said the main way in was stolen or exposed cloud identity tokens: leaked service-account keys, GitHub personal access tokens, API keys harvested from public repositories, and session tokens captured by a fake application portal that asked users to paste their access-token JSON, which bypassed passwords and multi-factor authentication. In several incidents, language-model services had not been enabled before the intrusion, and attackers switched them on with stolen keys. Mandiant also described attackers probing stolen keys with single-token requests to avoid volume alerts, and creating and deleting short-lived service accounts to evade rate limits.

Google Threat Intelligence Group identified a division of labour between actors who gain access and operators of “LLM Mixers”, gateways that pool stolen credentials and resell access. It said Jet Night’s unlimited plan, priced at about $60 a month against an estimated $100 to $250 typical market rate, led it to believe the service “relies on stolen keys to operate profitably”. That inference is Google’s, not something the service has acknowledged.

As relayed by The Register, John Hultquist, chief analyst at Google Threat Intelligence Group, said attackers want to use this technology “to gain a scale advantage over defenders”. Mandiant’s recommendations were mostly conventional controls: least-privilege access, secrets management and rotation, per-model spending caps, and treating any unauthorised enablement of a language-model service as a critical security event. The report adds a cost-and-resale dimension to earlier accounts of criminal misuse of AI systems.