A leaked password lets someone in. A leaked AI key lets someone spend. That difference is the core of a report Google published on 2 November, and it changes how every team using large language models should think about the keys in its code, its gateways and its cloud projects.
In The Rise of LLMJacking, Mandiant and the Google Threat Intelligence Group (GTIG) describe multiple 2026 incidents in which attackers hijacked an organisation's access to large language models and ran them at the victim's expense. Fraudulent charges passed $100,000 in a single day in some cases, and cumulative charges at some organisations reached $1 million before access was revoked. In one incident, more than 500,000 API calls in under eight hours powered a resale service called Jet Night and left the victim with nearly one million dollars in token costs.
Theft that bills by the minute
Cryptojacking, the older version of this crime, stole compute slowly enough that it could go unnoticed for weeks. LLMjacking is different. Frontier models are priced per token, and an attacker with a valid key can generate a large bill in hours. GTIG notes that in several incidents the victims did not even have the relevant model services switched on at the time of compromise. The attackers used stolen access keys to enable those services themselves, then created more keys to scale up.
The money does not stay with one attacker. GTIG describes a division of labour between groups that break in and operators of what it calls "LLM Mixers": gateways that pool stolen keys, meter usage, hide where requests come from and resell the access to underground subscribers. Jet Night, according to the report, offered an unlimited plan for about $60 a month with alleged access to frontier models, a level of service that would normally cost $100 to $250. GTIG believes prices that low only work on stolen keys, and that the outages Jet Night announced on its Telegram channel were likely victims finding and revoking them. The Register and SiliconANGLE covered the same findings.
How the keys leak
None of the entry points in the report is exotic. The dominant one, GTIG says, has been exposed or stolen cloud identity material: IAM credentials, service account keys, GitHub personal access tokens and active session tokens. Specific cases include:
- A misconfigured service account key that gave one group a foothold on a cloud instance, which it then used to grant itself access to an LLM API.
- A fake portal that asked users to paste a raw JSON payload containing an active access token, which bypassed both password and multi-factor checks.
- Keys committed to public GitHub repositories, harvested and quietly tested with single-token requests (
max_tokens=1) so the validation would not trip volume alerts. - A flaw in the model gateway itself. One group exploited CVE-2026-40217 in LiteLLM's key regeneration endpoint to turn ordinary virtual keys into full administrator credentials.
Once inside, attackers did what attackers always do: cloned repositories to look for hardcoded secrets, scanned logs for more credentials, created backdoor service accounts and injected SSH keys. One backdoor account was disguised as an internal billing optimisation tool.
The tooling around the models is part of the attack surface
The same week showed how much of that surface now sits in AI tooling. On 28 October IBM published a bulletin for Langflow, an open-source tool for building AI agents and workflows. As The Hacker News reported, every release from 1.0.0 through 1.12.8 contains two critical flaws rated 9.8 that let an attacker with no account bypass authentication or run arbitrary code, one of them through the server's Model Context Protocol (MCP) tool interface. A third flaw in the same bulletin covers insufficiently protected credentials. The fix is version 1.13.0, released on 22 October, which also turns automatic login off by default.
On 1 November, JFrog disclosed a flaw rated 10.0 in Prefab UI's sandbox for AI-generated code, and LinuxSecurity summarised separate Beta9 issues in which a sandbox could reach worker files, including a Kubernetes service credential. Neither advisory reports exploitation in the wild. Both make the same point as the Google report: the software that connects models to the rest of a system often holds the keys, and it is often newer and less reviewed than the systems it connects.
What we take from it
We spend much of our time on one question: who can use a key, and where does it live? In crypto, the answer decides who can move funds. LLMjacking shows that AI credentials now deserve the same treatment, because a model key is a payment instrument with no spending limit unless someone sets one. Drawing on GTIG's guidance and our own practice, this is the checklist we would apply:
- Treat every model key as money. Store it in a secrets manager, rotate it automatically and never place it in source code, front-end apps or shared configuration files. Scan repositories for secrets on every commit.
- Scope keys narrowly. Separate keys by environment and by model, so a key meant for a small utility model in development cannot call an expensive frontier model in production.
- Set hard limits at the provider. Per-model quotas and spending caps turn a million-dollar incident into a capped one. A budget alert that fires after the money is spent is useful, but it is not a limit.
- Watch for the quiet signals. Alert on new keys, newly enabled model services, logging changes and bursts of tiny validation requests. GTIG recommends treating any unauthorised enablement of an LLM service as a critical event.
- Patch the middle layer. Gateways, agent builders and code sandboxes belong in the same patch cycle as web servers. Langflow 1.13.0 and Prefab UI 0.21.0 are current examples.
- Use phishing-resistant multi-factor authentication on cloud consoles and developer platforms, so a stolen password or pasted token is not enough on its own.
The broader lesson is not specific to AI. Any credential that can spend, sign or approve should be protected according to what it can do, not according to how ordinary it looks. An API key in a configuration file looks ordinary. On 2 November, Google showed what one can cost.
