Google details stolen AI access schemes that ran up $1 million in corporate charges

Companies caught in AI resource theft accumulated more than $100,000 in unauthorized cloud charges in a single day, with some reaching $1 million before access was cut off. Google Threat Intelligence Group and Mandiant detailed the campaigns in a November 2 report: attackers steal enterprise credentials, then turn the access into model services for paying customers.

The findings draw on multiple Mandiant investigations during 2026 across different cloud and model providers. Affected organizations spanned North America, South America and Asia Pacific, in financial services, retail, technology and transportation. The tactic is known as LLMjacking—the hijacking of access to large language models.

A subscription business on someone else’s account

At the center are services Google calls LLM Mixers. These illicit gateways pool unauthorized model access and route subscribers’ requests through it. Operators use open-source gateways and custom relay software to combine stolen credentials, measure consumption and conceal where requests originate.

In one investigation, an actor used stolen third-party API keys—credentials that let software call a model—to power the Jet Night token-routing service. Google says the actor made more than 500,000 model calls in less than eight hours, passing nearly $1 million in token costs to the victim organization.

Jet Night advertised an unlimited-token plan for approximately $60 a month, with alleged access to frontier models. Google believes stolen keys make those economics possible. Its assessment is not a verification of the service’s advertised model access or unlimited-use promise.

The quiet tests before the spending spike

The dominant entry point in Mandiant’s investigations was exposed or stolen cloud identity credentials, including service-account keys and active session tokens. Attackers also harvested model API keys from public GitHub repositories and searched for model endpoints left open to the internet.

One group checked stolen keys with requests limited to a single output token, a tiny unit of generated text. Those tests confirmed working credentials without triggering the victim’s volume-based security alerts. Low initial consumption therefore did not mean the access was harmless.

After entry, attackers searched repositories, cloud services and data stores for more credentials. Some created unauthorized accounts or inserted SSH keys, which allow remote login to computers. Others abused existing permissions to obtain higher-privilege credentials and extract secrets from cloud secret managers.

The report also describes a handoff between attackers. After receiving pre-validated keys from the group that gained initial access, another group exploited a user-ID rebinding flaw in the LiteLLM routing gateway. The vulnerability, CVE-2026-40217, let it turn ordinary virtual keys into administrative credentials.

An AI bill without an AI deployment

In multiple cases, model services were not enabled when the compromise began. Attackers used stolen access to switch them on. Google urges defenders to treat unauthorized AI-service activation as a critical security event, rather than waiting for consumption to reveal the intrusion.

Once inside, one actor enrolled victim accounts in pay-as-you-go agreements, selected premium models and launched high-volume requests. It evaded rate limits by repeatedly creating and deleting short-lived service accounts, while checking the cloud billing interface to monitor the financial impact.

Google’s defensive recommendations, summarized by CSO, address both the stolen access and the resulting spending:

• Tighten credential management and limit each identity or API key to the permissions it actually needs.
• Monitor suspicious low-volume requests, unauthorized service activation and vulnerabilities in model-routing gateways.
• Set spending limits on model consumption to constrain the financial exposure.