A Stolen AI Key Can Burn $100,000 in a Day
Google's threat researchers describe attacks in which criminals hijack companies' access to AI models and run up the bill. In some cases, charges passed $100,000 in a single day and reached $1 million before access was cut off. The cost is a simple equation, and so is most of the defence.
Per-minute and per-hour figures assume the reported daily amount accrues evenly, a NodeZero calculation. Actual usage comes in bursts. Source: Google Threat Intelligence Group and Mandiant, LLMJacking (2 November 2026).
Companies pay for AI models the way they pay for electricity: by the amount used. That makes a stolen AI access key valuable to criminals. Whoever holds it can use expensive models, and the owner gets the bill.
Google Threat Intelligence Group and Mandiant call this LLMJacking. In a report published on 2 November 2026, they describe incidents in which fraudulent charges exceeded $100,000 in a single day, with cumulative charges at some organizations reaching $1 million before access was revoked (Google Cloud, 2 November 2026).
The size of the bill comes from a simple equation, and most of the defence follows from it: limit who can use the key, how much they can use and what each unit costs.
Why AI theft is faster than crypto theft
A familiar older attack, cryptojacking, uses stolen computing power to mine cryptocurrency. It tends to consume resources gradually. Google’s researchers note that LLMJacking can instead produce large spikes in charges within hours.
The reason is pricing. AI models are billed per unit of text processed (tokens), and the most capable models cost far more per token than basic ones. A stolen key that unlocks premium models turns every automated request into a meaningful charge.
The equation behind the bill
For usage-based AI services, the bill is roughly:
Bill = number of requests × amount of text per request × price per unit of text
Each part of the equation has a matching control:
| Part of the bill | What drives it up in an attack | Control that limits it |
|---|---|---|
| Who can make requests | Leaked keys, stolen cloud credentials | Secret scanning, short-lived credentials, phishing-resistant MFA |
| Number of requests | Automated scripts running around the clock | Per-model quotas, rate limits |
| Price per unit | Switching to the most expensive models | Keys limited to specific models and environments |
| Total spending | All of the above, until someone notices | Spending caps and budget alerts |
Controls drawn from the mitigation guidance in Google’s report.
The report gives one example of the scale involved: in one case, an attacker made more than 500,000 AI requests in less than eight hours Observed. That is more than 1,000 requests a minute Calculated by NodeZero, far beyond what most legitimate teams generate.
How attackers get in
The report is clear that the models themselves are rarely the weak point. Across Mandiant’s investigations, the most common way in was exposed or stolen cloud identity credentials: account keys, service account keys, code-repository tokens and active login sessions. Other routes included AI API keys accidentally published in public code repositories, AI servers left open to the internet, and unpatched software that routes requests to AI models.
In several incidents, the AI services were not even switched on when the attackers arrived. They used the stolen access to enable them, then started running up charges. That is why the report recommends treating any unexpected activation of an AI service as a critical security event.
Why it pays: stolen access is resold cheaply
Some attackers do not use the stolen access themselves. They pool many stolen keys and resell AI access to paying customers through underground services that the researchers call LLM Mixers.
The report describes one such service offering an “unlimited” plan for about $60 a month, against $100 to $250 a month for a comparable legitimate consumer service Observed. It passed nearly $1 million in token costs to one victim organization. The researchers believe its low price is possible only because someone else pays for the computing.
The legitimate range is the researchers' estimate for a typical consumer service level; the bar shows its midpoint. Source: Google Threat Intelligence Group and Mandiant, LLMJacking (2 November 2026).
This is the same price-and-volume logic NodeZero applies to markets, turned upside down: the reseller can charge a low price at high volume because its cost per unit is zero. The victim bears the full unit cost.
The clocks that matter
An LLMJacking incident is a race between three clocks:
- The usage clock. Charges start as soon as requests do. At the rates in the report, that is thousands of dollars an hour.
- The detection clock. Security alerts may not fire if the attacker’s requests look like normal API traffic. The report notes that some attackers first test stolen keys with tiny requests that stay below volume alerts.
- The billing clock. Budget alerts depend on billing data, which in many cloud accounts updates periodically rather than instantly. Check how often yours updates.
The difference between them is the exposure. A hard spending cap or quota stops the usage clock directly, which is why it is the most effective single control against a runaway bill.
A defensive checklist
Drawn from the report’s recommendations, in order of how directly they cap cost:
- Set spending caps and per-model quotas on every AI service, including in development and test accounts.
- Alert on activation: treat any unexpected enabling of an AI service as a critical event.
- Scope keys narrowly: limit each key to the specific models and environments it needs, so a key for a basic model cannot call the most expensive one.
- Scan code for secrets automatically, and rotate keys through a central secrets manager.
- Use least privilege for users and service accounts, including denying AI services where they are not needed.
- Enforce phishing-resistant MFA on cloud consoles and developer platforms.
- Patch the software that routes AI requests, not only the applications that use it.
- Watch for unusual patterns, such as many tiny test requests or traffic at times your teams do not work.
What the numbers do not tell us
- How common it is. The figures come from incidents Mandiant investigated. They show what can happen, not the typical cost or how many organizations are affected.
- Averages. $100,000 a day and $1 million in total are the largest figures reported, not averages.
- Even spending. The per-minute and per-hour figures assume charges accrue evenly; real attacks come in bursts.
- Who pays in the end. Whether cloud providers refund fraudulent charges depends on the provider and the case; the report does not say.
Key terms
- LLMJacking: hijacking an organization’s paid access to large language models (LLMs) to use or resell it, leaving the organization with the bill.
- API key: a secret string that lets software use a paid service; whoever has it can usually spend on the owner’s account.
- Token: a small unit of text (roughly a short word or part of a word) by which AI models are billed.
- Quota / spending cap: a limit on how much can be used or spent; once reached, further requests are blocked.
- Least privilege: giving each user or system only the access it needs.
- Cryptojacking: using stolen computing power to mine cryptocurrency.
Notes on the data
- All incident figures come from Google Threat Intelligence Group and Mandiant’s report of 2 November 2026, based on incidents Mandiant responded to in 2026.
- Per-minute ($69) and per-hour ($4,167) rates divide $100,000 by 1,440 minutes and 24 hours. The requests-per-minute figure divides 500,000 requests by 480 minutes. These are NodeZero calculations.
- The $1 million figures appear twice in the report: as the cumulative total at some organizations, and as the token costs one resale service passed to one victim. They may refer to different incidents.
- This article describes the problem and defensive measures only. It does not describe how to carry out any attack, and names no affected organizations.
Sources
Primary: Google Threat Intelligence Group and Mandiant – The Rise of LLMJacking (2 Nov 2026)
Every figure in this article links to its source and was checked against that source before publishing. How we check figures