What happened
Google's Mandiant incident responders published a report on 2 November describing what the industry calls LLMJacking: criminals hijacking an organisation's access to large language models and running up the bill. Fraudulent charges from resource consumption now exceed 100,000 dollars a day at some victims, and cumulative charges at a few organisations reached a million dollars before access was revoked.
"Whenever possible, threat actors want to use this technology to gain a scale advantage over defenders," John Hultquist, chief analyst at Google Threat Intelligence Group, told The Register. "They achieve that with agentic tools and by stealing tokens from unwitting third parties."
One group Google tracks as UNC6993 obtained LLM API keys, generated more keys and enabled services inside the victim's cloud projects, producing 100,000 dollars in charges. Another intruder subscribed victim accounts to pay-as-you-go agreements so advanced models could be used at the victim's expense, selected premium foundation models, pushed high volume inference streams, and used a burn and rotate approach to dodge rate limits by creating and deleting short lived service accounts while watching the billing interface to track the financial impact.
In a third incident, an intruder made more than 500,000 LLM API calls in under eight hours using stolen third party keys to power a token routing service called Jet Night. Google's report notes that Jet Night's per token prices sit far below market rates, with an unlimited plan at roughly 60 dollars a month for access to frontier models that would normally cost between 100 and 250 dollars.
Google also describes a division of labour inside the ecosystem, between criminals who establish initial access and others who run the downstream monetisation infrastructure it calls LLM Mixers. In one case Mandiant handled in mid 2026, UNC6993 reached a cloud instance through a misconfigured service account key and used that access to grant itself a model API.
Why this is a GRC story
This is a financial control problem before it is a security problem. A six figure daily run rate means the signal that matters most is a billing anomaly, not an intrusion alert. Budget owners, not only the security operations centre, should be looking at spend velocity by project and by key.
Identity hygiene is nearly the whole control set. Misconfigured service account keys, keys committed in code, keys without owners and long lived tokens with broad model access appear in every case described. Least privilege for service accounts and a central secrets store with enforced rotation are unglamorous, and they close most of this.
Agentic tooling raises the ceiling on damage. An agent holding a valid token does not need to break in. It consumes, at machine speed, inside whatever quota you granted.
Third party exposure counts too. Stolen keys are often someone else's keys, resold at a discount, so vendor risk teams should ask providers how they detect key abuse.
What to watch
Watch for cloud providers tightening default quotas and adding spend anomaly alerts specific to model APIs, because that is where this becomes preventable rather than merely detectable. Watch whether cyber insurers start asking for AI consumption controls in renewal questionnaires, which would push the issue into board reporting faster than any regulator. Google expects attackers to favour LLMJacking over cryptojacking.
Attribution: Analysis based on The Register and related public reporting. This article is original commentary, not a repost of the source material.