LLMjacking is the theft of someone else’s access to large language models, usually through stolen cloud credentials or API keys, so that the thief can use or resell the models while the victim pays the bill. In a report published on November 2, 2026, Google Threat Intelligence Group and Mandiant said they had seen fraudulent charges above $100,000 in a single day and cumulative losses of about $1 million at some organizations. A week later the inference provider Fireworks AI linked its own breach to a group in this trade. This deep dive explains how the attack works, how the stolen access is turned into money and what defenders can do.
Where the term comes from
The name dates from May 2024. Researchers at the cloud security company Sysdig described an attack in which stolen cloud credentials were used to reach ten hosted model services. The credentials came from a server running a vulnerable version of the Laravel web framework. Sysdig found a reverse proxy set up to share the compromised accounts and concluded that the likely aim was to sell model access to other criminals. It estimated the potential cost to a victim at more than $46,000 a day.
The comparison in the name is with cryptojacking, where intruders use a victim’s servers to mine cryptocurrency. Google’s report draws the same line and notes the difference. Cryptojacking drains resources gradually. LLMjacking can produce a large spike in charges within hours, because premium models are billed per token and an attacker can send requests as fast as rate limits allow.
By 2026 the practice had spread. Mandiant says it responded to multiple incidents this year across several cloud and model providers. The victims were in North America, South America and Asia Pacific, in financial services, retail, technology and transportation.
How attackers get in
Attackers do not go through a chatbot’s front end. Google says they aim at the back end, either by finding model endpoints left open to the internet or by obtaining valid keys.
Open endpoints are the simplest case. The report shows an automated script that tests exposed Ollama servers and tries to register its own models on them.
The main route, though, is identity. Across Mandiant’s investigations the dominant way in was an exposed or stolen cloud identity token: an IAM credential, a service account key, a GitHub personal access token or an active session token. The report gives several examples:
- A misconfigured service account key gave a group that Google tracks as UNC6993 access to a cloud instance, which it then used to grant itself access to a model API.
- The same group ran a fake application portal that persuaded users to paste a block of JSON containing a live access token, which bypassed passwords and multi-factor authentication.
- Another actor collected corporate API keys that developers had committed to public GitHub repositories.
That last actor also showed how quietly keys can be checked. It validated each stolen key with a request for a single output token. A request that small confirms the key works and stays below the volume alerts that security teams usually set.
What happens inside the victim’s cloud
Once inside, attackers behave much like any other cloud intruder. They list services across regions, clone private code repositories to search for hardcoded secrets, read access logs for credentials to other environments and query secret managers. To keep access they create new IAM users and service accounts and inject SSH keys into virtual machines. One group disguised its backdoor service accounts as internal billing-optimization tools.
Two details are specific to AI infrastructure. First, the model service often is not even switched on when the intruder arrives. Mandiant says that in multiple incidents the attacker used stolen keys to enable services such as Amazon Bedrock or the Gemini API, then ran up charges in minutes or hours. Google advises treating any unauthorized enablement of a model service as a critical security event.
Second, the routing software that companies place in front of their models has become a target. In one case an actor that had bought working keys from another group exploited a flaw in the victim’s LiteLLM gateway, tracked as CVE-2026-40217, to turn ordinary keys into full administrator credentials. The hand-off between the two groups is itself notable: Google describes distinct clusters that specialize, one in getting access and another in exploiting it.
How stolen access becomes money
The end goal is to convert someone else’s quota into revenue. Google describes three methods: proxying tokens, streaming requests to models automatically and renting GPU hardware on the victim’s account.
UNC6993 tried to create extra API keys and enable more services in victim projects and quickly passed $100,000 in charges. Another actor signed victim accounts up for pay-as-you-go agreements on premium models. To get around rate limits it kept creating and deleting short-lived service accounts, a pattern the report calls “burn and rotate”, while checking the billing console to see how much it had spent.
The resale layer is what Google calls LLM mixers. These are gateways that pool many stolen keys, meter each buyer’s usage and hide where requests come from. They are built from open-source gateway software that has ordinary legitimate uses. The buyers see something that looks like a normal API or subscription.
The clearest example in the report is a token-routing service named Jet Night. One actor made more than 500,000 model API calls in under eight hours with stolen keys to supply it, passing nearly $1 million in token costs to the victim. Jet Night offered an unlimited plan with claimed access to frontier models for about $60 a month. Google says a comparable consumer service level would normally cost between $100 and $250 a month and concludes that the price only works if the keys are stolen. The service’s Telegram channel has announced repeated outages, which Google attributes to victims revoking keys.
Why the Fireworks AI breach fits the pattern
The Fireworks incident shows what happens when the victim is itself an AI vendor. In its November 9 bulletin, Fireworks said the evidence pointed to a financially motivated group that sells tokens from unauthorized model access to illicit routing gateways, and it cited Google’s report.
The sequence matches the playbook above. According to Fireworks’ first bulletin, the intruder used internal credentials to read environment variables in customers’ evaluation jobs, which is where API keys and tokens were stored as secrets. For someone who resells model access, a platform that holds many customers’ keys to other providers is an efficient target. Fireworks told customers to rotate those third-party credentials with the providers that issued them, since deleting a stored secret does not invalidate the key.
The damage did not stop at keys. In a second wave on October 24 the intruder ran an unauthorized workload on Fireworks development machines, and billing data, datasets and partial model weights were exposed. One customer, Notion, later confirmed that stored chat transcripts were taken. We cover that side in our report on the Fireworks AI breach and Notion AI transcripts.
The point for risk planning is that a thief who comes for billable tokens can still leave with data. A similar exposure of stored credentials happened in the OpenCode console breach in October.
What LLMjacking costs compared with cryptojacking
It helps to put the published figures side by side. Sysdig’s 2024 estimate was more than $46,000 a day for one compromised account. Google’s 2026 cases exceed $100,000 in a day, and the Jet Night case reached nearly $1 million in under eight hours. Taken at face value that last case is about $125,000 an hour.
Three things explain the rise. Frontier models cost more per request than the models of 2024. Agent workloads make very high request volumes look normal, so abuse is harder to spot. And the mixers give thieves a ready market, which was only suspected in the first Sysdig case.
The speed changes the defensive problem. A monthly invoice review, which might catch a cryptomining server, is far too slow here. The controls that matter are the ones that act within minutes: hard spending caps, per-model quotas and alerts on service enablement.
A defensive checklist for teams that use model APIs
Google’s report lists many mitigations. These are the ones that apply to almost any team that calls a hosted model, in rough order of effort:
- Set spending caps and per-model quotas. A cap turns an unlimited loss into a bounded one.
- Scope every key. Restrict keys by model, environment and usage limit, so a key for a cheap utility model cannot call an expensive one. Our guide to least-privilege API keys for AI coding agents walks through this.
- Scan code for secrets automatically. Public repositories are a known source of stolen keys.
- Deny model services by default. Accounts and roles that do not need Bedrock, Vertex AI or similar services should not be able to enable them.
- Alert on tiny test requests. Watch gateway logs for single-token requests from unfamiliar clients.
- Patch the gateway. Treat LiteLLM and similar proxies as production software with their own vulnerability management.
- Close open endpoints. Audit for self-hosted model servers reachable from the internet.
- Use phishing-resistant multi-factor authentication on cloud consoles and developer platforms.
For teams that buy AI through another vendor, add one question to procurement: which of our secrets and conversations does the vendor store, and for which features? Prompt-level attacks are a separate risk, covered in our explainer on prompt injection and LLM security.
What to watch next
- Whether cloud providers make spending caps and service-enablement alerts the default for model APIs.
- Law-enforcement action against resale gateways named in Google’s report.
- Further disclosures from Fireworks AI customers as its investigation continues.
- More vulnerabilities in model gateways and routers, now that attackers target them directly.
Key takeaways
- LLMjacking is the theft and resale of access to hosted language models, with the victim paying the usage bill.
- Stolen cloud identity tokens, not chatbot tricks, are the main way in, according to Mandiant’s 2026 cases.
- Google saw charges above $100,000 in a day and one case near $1 million in under eight hours.
- Stolen keys are pooled in gateways called LLM mixers and sold as cheap subscriptions.
- Spending caps, narrowly scoped keys and alerts on model-service enablement limit the damage fastest.
Frequently asked questions
What is LLMjacking?
LLMjacking is the unauthorized use of another organization’s access to large language models, typically through stolen cloud credentials or API keys. The attacker uses or resells the access and the victim is billed for it.
How do I know if my AI API key has been stolen?
Look for unexpected spikes in usage or spending, model services you did not enable, new keys or service accounts you did not create, and very small test requests from unknown clients. Rotate the key immediately if you see any of these.
How is LLMjacking different from cryptojacking?
Both steal computing resources that the victim pays for. Cryptojacking mines cryptocurrency slowly on hijacked servers, while LLMjacking runs up per-token model charges that can reach six figures within a day.
