Google’s Mandiant says criminals hijacking corporate AI access are running up more than $100,000 a day in token charges. At some victims, the total hit $1 million before anyone shut it off. This is called LLMjacking.
How they do it
- A group Google tracks as UNC6993 stole LLM API keys, made more keys and turned on services in the victim’s cloud projects. That cost $100,000.
- Another one signed victim accounts up for pay-as-you-go plans, picked premium models and ran high-volume inference. They kept creating and deleting short-lived service accounts to dodge rate limits.
- One intruder made 500,000+ API calls in under eight hours.
- A fake “join our LLM group” page tricked users into pasting their raw access token, which got around passwords and MFA.
Google says a cheap reseller called Jet Night (about $60/month for “unlimited” frontier models) probably runs on stolen keys. It keeps going down, likely when victims revoke them.
Lock down your keys and set spend caps. I wrote up how in today’s how-to.
God Bless, and Use the Source!
