Stolen AI access keys can cost over $100,000 in a single day, Google warns

A request that allows only one response “token” from the AI. For a monitoring tool, nothing unusual. According to Google, though, this is how some hackers check that a stolen access key still works, before running it at full throttle.

In a report published on November 2, 2026, Google's Threat Intelligence Group (GTIG) and its subsidiary Mandiant describe “LLMjacking”: the hijacking of access that a company has opened to large language models (LLMs) in the cloud. Mandiant says it responded to several of these incidents in 2026, in North America, South America and Asia-Pacific, in finance, retail, technology and transportation. At some victims, fraudulent charges exceeded $100,000 in a single day. They reached up to $1 million in cumulative costs before access was cut off.

Access thieves on one side, resellers on the other

Google describes a division of labor. Some hackers obtain access: misconfigured service account keys, GitHub tokens, AI API keys left in public GitHub repositories. Others, which Google calls “LLM mixers,” bundle that access and resell it to underground subscribers.

One of them, Jet Night, offers an unlimited plan for about $60 a month with supposed access to the most advanced models. For an individual, a legitimate subscription at that level usually costs between $100 and $250. Google estimates that this service can only be profitable with stolen keys. One hacker fed it with stolen keys, running more than 500,000 calls in under eight hours. Jet Night left one organization bearing nearly $1 million in usage.

The group dubbed UNC6993, meanwhile, took advantage of a misconfigured service account key. It also set up a fake page presented as a portal to join an AI user group. Victims were invited to paste raw JSON data containing an active access token, which bypassed the password and multi-factor authentication. The hackers then tried to create new keys and enable services, racking up more than $100,000 in charges. To stay in place, another group created service accounts disguised as internal billing-optimization tools and added its own SSH keys to virtual machines.

A LiteLLM flaw to become administrator

In another case, attackers exploited a flaw in LiteLLM, a widely used gateway for centralizing access to several AI models. According to Google, this flaw, which it identifies as CVE-2026-40217, let them turn ordinary keys into gateway administrator credentials. The official entry for that CVE, however, describes a different LiteLLM flaw, one that allows remote code execution. LiteLLM had already made headlines in October, when a booby-trapped version stole its users' cloud access.

The catch lies in billing: the hackers exhaust the company's quotas and leave it with the bill, before the intrusion is even detected. Google expects hackers to increasingly prefer this hijacking to cryptocurrency mining on stolen servers.

What should you do?

In several of the cases described, everything started with an overexposed key or account. Google recommends:

• treating any unplanned activation of a cloud AI service as a critical security incident;
• denying by default all permissions that are not essential, including access to cloud AI services;
• setting quotas and spending caps per model, and separating keys by model and by environment;
• centralizing secrets with automatic rotation, and enforcing phishing-resistant authentication;
• enabling and monitoring logs: CloudTrail for Bedrock on AWS (any attempt to turn off logging that does not come from automated deployment tools, known as “infrastructure as code,” should be treated as serious), activity and diagnostic logs (to be enabled to see model calls) for Microsoft.CognitiveServices on Azure, and data access logs for aiplatform.googleapis.com on Google Cloud, which are disabled by default;
• spotting unusual tiny requests (max_tokens=1) that may betray a test of stolen keys;
• updating gateways like LiteLLM at the same pace as the rest of your systems.

Google also publishes two reseller domains to block: jet-night.com and newapi.pro. The report mentions no victims in Europe. Yet the entry points it describes, forgotten keys and overly permissive accounts, are specific to no region. If you store AI keys with third-party tools, the OpenCode episode shows they can leak from there too.