Google's Mandiant says hijacked enterprise AI accounts ran up fraudulent bills above $100,000 a day
Google Threat Intelligence Group describes 2026 'LLMjacking' incidents across finance, retail, tech and transport, in which stolen cloud keys were used to resell model access; cumulative charges at some victims reached $1 million before access was cut.
Why it matters
Cryptojacking quietly burned stolen computing power over weeks; hijacked access to AI models can run up huge bills within hours, because attackers resell the access to paying users. Mandiant's incident data shows this is now a regular cost of running AI in the cloud, not a rare oddity. It means leaked API keys and cloud credentials carry a direct dollar price. Watch for cloud providers adding default spending caps and faster anomaly alerts on model usage.
Key facts
- Fraudulent charges topped $100,000 in a single day in some incidents.
- Cumulative charges at some organisations reached $1 million before access was revoked.
- Victims were in North America, South America and Asia Pacific.
- Sectors hit included financial services, retail, technology and transportation.