LLMJacking attacks rack up $100K+/day in stolen AI token charges

Google Mandiant reported a rising wave of 'LLMJacking' attacks in which criminals steal corporate LLM API keys and cloud credentials to run unauthorized high-volume AI inference, generating illicit charges exceeding $100,000 a day and cumulative losses up to $1 million at some victim organizations before access was revoked.

Occurred 1 June 2026 · Disclosed 2 November 2026 · Record updated 2 November 2026

Impact

Multiple organizations incurred massive fraudulent LLM usage charges (up to $1 million cumulative) after attackers stole API keys and cloud credentials, with one group making over 500,000 API calls in under eight hours and another sending 200,000 requests in two minutes.

Our coverage

Incidents

Stolen LLM keys run up $100,000 a day in victims' bills

Google Mandiant says criminals hijacking corporate AI credentials have cost some organisations up to $1 million before access was cut off.

2 Nov 2026

Sources

theregister.comhttps://theregister.com/security/2026/11/02/token-thieves-costing-companies-100k-per-day-in-illicit-llm-charges/5306967