Hackers Hijacked AI Cloud Accounts. Some Victims Faced $1 Million in Charges.

A stolen AI API credential can now create a cloud bill large enough to threaten an organization’s budget in hours, not months. In incidents investigated during 2026, Google's Mandiant team saw unauthorized AI resource charges top $100,000 in a single day, with some companies accumulating as much as $1 million before the compromised access was stopped. The researchers call the business model LLMjacking.

The investigators detailed the incidents in Google Threat Intelligence Group's November 2 report. The sums refer to observed cases, not a typical victim's loss or a guaranteed charge; the report draws on cloud incidents across several sectors and regions.

The target is the meter behind the chatbot

AI applications are not just text boxes. Their backend API requests consume metered model inference, high-powered GPUs and other cloud services. A company pays for those requests whether its legitimate customer initiated them or a thief is secretly spending its credentials. The profitable target is therefore not necessarily a chatbot's public screen. It is the authorized billing relationship attached to a key, service identity or cloud project.

Mandiant describes several routes into those resources: exposed service accounts, compromised identity tokens, keys leaked into repositories, and inadequately secured model endpoints. After entry, some intruders created additional accounts or switched on costly services, making the eventual bill larger. The investigation also describes separate groups specializing in access and resale, showing how cloud AI abuse is turning into a structured illicit market rather than isolated hobbyist misuse.

Stolen access is sold as discounted AI capacity

One observed pattern involved 'LLM mixers'—intermediaries routing subscribers' AI queries through compromised infrastructure. Buyers may see a cheap service that appears to provide generous access to commercial models; behind it, costs accrue to the real owner of the stolen credentials. Mandiant documented one service routing more than 500,000 calls in less than eight hours and passing nearly $1 million in token charges to a victim organization.

A BleepingComputer report explains the resale economics: cloud providers often record the stolen usage as valid consumption until the compromise is detected and keys are revoked.

The label LLMjacking resembles cryptojacking, in which attackers use somebody else's compute to mine cryptocurrency. The difference is the product: access to paid AI inference or GPU capacity, which can create high charges almost immediately. This is not evidence that AI models themselves have escaped control or that all providers are equally vulnerable. It is an identity, application and billing-security problem.

Warning signs a small AI business can actually monitor

An abnormal surge in requests is the obvious signal, but waiting for a billing spike can be too late. A more useful control set includes alerts for unexpected service activation, unfamiliar service accounts, new credentials, unusual inference regions, changes to security logging and usage by projects that should be idle. Examine model usage at the project and account level rather than only an aggregate monthly bill. Rate limits and budget notifications can provide early warnings, but are not always hard spending caps.

The same fundamentals that secure other cloud software still matter: rotate leaked secrets, keep keys out of code repositories, grant the minimum permissions needed to each workload, enforce strong multifactor authentication for human administrators and isolate model gateways. For existing deployments, inventory all API credentials and check who can create more of them. A monitoring dashboard without an incident-response owner is not a sufficient defense.

Reporting by The Register included additional commentary from Google Threat Intelligence on the advantage attackers gain when organizations leave expensive AI resources unguarded.

What to do if the bill starts rising

If unauthorized usage is suspected, treat it as an active security incident rather than a cost-optimization problem. Revoke or disable exposed keys and sessions, lock down associated service identities, preserve relevant logs, inspect unexpected deployments and contact the cloud provider's security and billing teams. Contain affected services while preserving evidence that can explain the timeline and support any billing dispute. Affected organizations should not assume a refund is automatic.

A founder building AI tools can implement a baseline quickly: separate development and production projects, set conservative quotas, alert on cost anomalies, review service-account privileges and test that credential revocation works. Those measures do not eliminate sophisticated compromises, but they reduce the window between unauthorized usage and human intervention.

The broader warning from Mandiant's cases is that the market for AI is producing a parallel market for stolen AI access. Businesses that advertise intelligent automation while treating model keys like disposable configuration strings are exposing a new and expensive failure mode. Security has to follow the bill all the way from the user action to the cloud identity that pays for the inference.