Google and Mandiant: stolen cloud AI access is being resold, with victims billed up to $1 million

Google's threat intelligence team and its incident-response arm Mandiant reported on November 2, 2026 that criminals are breaking into companies' cloud accounts, switching on AI model services, and reselling that access to paying customers, with single incidents generating more than $100,000 in fraudulent charges in a day and some organizations billed up to $1 million before access was cut. Any organization with an AWS, Azure or Google Cloud account is a potential target, even if it never uses AI there. The practical fix is spending caps on AI services, tighter key scopes, and alerts when an AI service is suddenly enabled or its logging switched off.

What happened, in plain English

Companies increasingly use large language models (LLMs, the technology behind chatbots like ChatGPT, Claude and Gemini) through their cloud providers: Amazon Bedrock on AWS, Azure's AI services, Google's Vertex AI. Usage is billed per request, to whichever account the request comes from.

"LLMjacking" is the name for stealing that access. In its November 2 report, Google Threat Intelligence Group (GTIG) and Mandiant describe incidents they responded to during 2026 in financial services, retail, technology and transportation organizations across North America, South America and Asia Pacific.

The attackers rarely hack the AI itself. They steal ordinary cloud credentials: access keys, service account keys, GitHub tokens, or login session tokens, often found in public code repositories or tricked out of users. With those, they turn on AI services the victim may never have used, create new keys, and start sending requests.

What is new is the business model. Instead of using the stolen access themselves, criminals feed it into what GTIG calls "LLM Mixers": underground services that pool many stolen accounts and sell cheap subscriptions to frontier AI models. One service, Jet Night, offered "unlimited" access for about $60 a month, against the $100–250 that consumer plans typically cost. GTIG says one actor made more than 500,000 requests through a victim's account in under eight hours, and that Jet Night "passed nearly one million dollars in token costs to the victim organization."

Think of a stolen company fuel card that is not used by the thief, but sold on to dozens of strangers who all fill up at once. The company only notices when the statement arrives.

Are you affected? What to do now

Everyone with a public cloud account should care, including those who do not use AI: in several incidents, GTIG says, the AI services were not enabled before the compromise. You do not need to be an AI shop to receive an AI bill.

Check exposure (this week)

• Ask your cloud admin whether AI services (Amazon Bedrock, Azure AI / Cognitive Services, Google Vertex AI) are enabled in any account or project, and whether that was intended.
• Review billing for unexplained AI or GPU charges, and for quota-increase requests nobody filed.
• Search code repositories and CI/CD (automated build) systems for committed cloud or AI API keys; turn on secret scanning in GitHub or GitLab.
• If you run an AI gateway such as LiteLLM, or a self-hosted model server such as Ollama, confirm it is not reachable from the internet without authentication, and that it is on the latest release.

Harden (this month)

• Set spending caps and per-model quotas on AI services, with alerts that go to security as well as finance.
• Deny AI service permissions by default; grant them only to the identities that need them.
• Scope API keys by model, environment and spend, so a key for a small internal tool cannot call the most expensive models.
• Use short-lived credentials and automated rotation instead of long-lived keys.
• Require phishing-resistant multi-factor authentication (MFA), such as passkeys or security keys, for cloud consoles and developer platforms.

Detect (for security teams)

GTIG's core advice: treat any unauthorized enablement of an AI service, or any change to its logging, as a critical security event. The report lists the log events to watch on each cloud, including in AWS CloudTrail Bedrock model-access and invocation-logging changes, in Azure new model deployments and diagnostic-setting changes, and in Google Cloud service enablement for Vertex AI. It also recommends alerting on unusual very small requests, which attackers use to test whether a stolen key works. Note that in Google Cloud, the logs for individual model calls are off by default, and in Azure they require Diagnostic Logs to be turned on.

If you find nothing unusual and already have spending alerts, you have nothing urgent to do.

The expert view

The mechanism. This is cloud credential theft with a new cash-out. GTIG says the dominant entry vector was exposed or stolen cloud identity material, not abuse of chatbots or public AI endpoints. Initial access included session-hijacking pages that persuade a user to paste a token (bypassing password and MFA), federation tokens used to mint fresh access keys, keys scraped from public GitHub, and unauthenticated Ollama servers on which attackers registered their own models. Persistence looked like any cloud intrusion: backdoor service accounts disguised as "internal billing optimization utilities", SSH keys pushed through instance metadata, and abuse of token-creation rights to impersonate more privileged accounts.

What is genuinely new. LLMjacking itself has been documented since 2024, and we covered Wiz's analysis of nine October breaches at AI developer platforms on November 1. Google's report adds three things. First, a clear division of labor: initial-access actors on one side, Mixer resellers on the other, with open-source key-pooling tools (new-api, gcli2api) as the plumbing. Second, operational tradecraft such as validation sweeps with single-token requests that stay under consumption alerts, and a "burn and rotate" pattern of short-lived service accounts to dodge rate limits. Third, AI gateways as a target: GTIG says a follow-on actor abused a LiteLLM flaw, CVE-2026-40217, to turn ordinary virtual keys into administrative credentials. GTIG's description of that flaw (a user-ID rebinding issue in key regeneration) differs from the public CVE record, which describes code execution through a guardrail-testing endpoint; the practical advice is the same either way: bring LLM proxies into patch management and run a current release.

Why it matters. GTIG contrasts this with cryptojacking, which burned CPU slowly: "Unlike the gradual resource consumption associated with cryptojacking, LLMJacking can generate large spikes in fraudulent cloud charges in a matter of hours." The economics favor attackers. Stolen frontier-model access has ready buyers, and the victim pays. GTIG expects that threat actors "will increasingly prioritize LLMJacking over traditional resource theft like cryptojacking."

GTIG also names a persona, D1337-KAIROS, that rebranded frontier-model endpoints and ran a containerized backdoor built on an open-source AI agent framework. That blurs the line between stealing AI and using AI in an intrusion.

The broader trend. Developer infrastructure keeps surfacing as the soft spot. Separately, documentation platform GitBook said on November 3 that a "sophisticated, highly targeted attack using AI agents" had reached its infrastructure. Its November 4 postmortem says the attacker abused a flaw in GitBook's single sign-on login flow, used a misconfigured GitHub App integration at one customer to reach internal code and a Cloudflare API key, and from there gained production access. GitBook says API and integration tokens, session signing secrets and customer content were accessible, revoked all personal API tokens and asked customers to rotate secrets. It says the attack's speed "pointed to an attack driven largely by automation and AI", which is its inference rather than a finding. Nothing public links that incident to LLMjacking, but the lesson overlaps: tokens stored on third-party platforms are part of your attack surface.

What is still unknown. GTIG does not say how many organizations were hit, name victims, or attribute the activity to any country; UNC6993 is an uncategorized cluster, which means Google has not tied it to a known group. Total losses across the ecosystem, and whether cloud providers will refund fraudulent AI charges, are not addressed.

Official sources

• Google Threat Intelligence Group and Mandiant — LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources (November 2, 2026)
• CVE-2026-40217 record and references (CIRCL vulnerability lookup)
• GitBook — Security incident notice and postmortem (November 3–4, 2026)
• Wiz Research — "Black October" for AI Developer Platforms (October 30, 2026)
• Coverage: CSO Online — Enterprises pay $100,000 a day for AI they never ordered (November 3, 2026)