Stolen AI API keys generated nearly $1M in charges for a single company
Google Threat Intelligence Group and Mandiant report a wave of 2026 incidents dubbed LLMJacking, in which attackers hijack enterprise access to large language models, mainly through exposed cloud identity tokens and stolen API keys. Fraudulent charges exceeded $100,000 in a single day in some incidents and reached a cumulative $1 million at some organizations, with stolen access resold through illicit LLM Mixers. It matters because LLM credentials have become directly monetizable: a leaked key is now a billing risk, not just a data risk.
SOURCES
- Hacker News (AI)2026-11-03 00:32