LLMJacking Turns Stolen Cloud Credentials Into a Resale Market for Model Access

TL;DR

• LLMJacking is the theft of access to a commercial language model, through a cloud credential, an API key or a live session token, and its use or resale by someone who never paid for the inference.
• On 3 November 2026 Google Threat Intelligence Group published what its Mandiant incident teams found during 2026: intrusions against cloud and model providers at organisations in North America, South America and Asia Pacific, across financial services, retail, technology and transportation.
• Fraudulent charges can exceed $100,000 in one day. Individual victims saw more than $100,000 of fraudulent charges in a single day, and cumulative bills at some organisations reached $1 million before access was revoked.
• Initial access runs through cloud identity, meaning IAM credentials, service account keys, GitHub personal access tokens and active session tokens, and through LLM endpoints that were left publicly reachable.
• LLM Mixers form the wholesale tier of that market: routing gateways that pool stolen keys, meter them and resell access to underground subscribers. One service advertised unlimited tokens at roughly $60 a month.
• A privilege-escalation flaw in the LiteLLM gateway, CVE-2026-40217, turns a standard virtual key into proxy administrator, which puts every credential behind that gateway inside the blast radius.
• Detection works when service enablement and spend become security events: a model API switched on outside change control, a budget that moves in a day, a key that only ever asks for max_tokens=1.
• The controls that change the exposure are unglamorous and already documented: phishing-resistant MFA, key scopes per model, spend caps per provider, gateway patch management and credential scanning in every repository.

On 3 November 2026 the Google Cloud blog published The Rise of LLMJacking, signed by nine researchers from Google Threat Intelligence Group and Mandiant, among them Christopher Romano, Codi Starks, Garrett Mahoney and John Wolfram. The report describes work that had been invisible from the outside: enterprises whose model access was taken over, and a criminal layer that had formed around selling that access onward. Read it as an incident retrospective with a price list attached.

Mandiant counted the bill before it counted the intrusion

The opening figure is money. Across individual incidents the researchers observed fraudulent resource charges above $100,000 USD in a single day, with cumulative charges at some organisations reaching $1 million USD before access was revoked. These incidents produced rapid, high-value billing spikes. LLMJacking can generate large spikes in fraudulent cloud charges in a matter of hours, with observed charges exceeding $100,000 in a single day.

For the defender, a sudden inference bill is a monitoring signal that warrants immediate investigation. The report covers victims in financial services, retail, technology and transportation. The researchers also record the uncomfortable detail that several victims had never enabled the model services that were later used against them.

Initial access runs through cloud identity and reachable model endpoints

The report describes two access paths: publicly exposed LLM endpoints and stolen cloud identity tokens. Threat actors scan for publicly exposed LLM endpoints, and the report shows an automated script calling /api/create on unprotected Ollama installs to register and run their own models on someone else's host. An exposed inference endpoint is a compute grant to whoever finds it first.

Exposed or stolen cloud identity tokens were the dominant initial-access vector. Exposed or stolen cloud identity tokens open the environment: IAM credentials, service account keys, GitHub personal access tokens and active session tokens. In mid-2026 one cluster, tracked as UNC6993, entered through a misconfigured service account key, then hosted a session-hijacking page dressed as an application portal. The page asked users to paste a JSON payload containing an active access token, and posted it to the backend API, which walked past both password and multi-factor authentication. Another actor harvested corporate model keys from public GitHub repositories and validated them with single-token requests, max_tokens=1, chosen so that request volume never crossed the threshold of a SIEM volume alert.

The practical consequence is the need for a complete inventory of model services, credentials and scopes. A team that cannot list which model providers are enabled in each project, which keys reach them, and what each key is scoped to cannot answer a single question the report raises. Model credentials now sit in the same category as database passwords, and they are usually younger, spread across more tools and issued with wider scope.

LLM Mixers form the wholesale tier of stolen inference

The organisational finding is the one worth carrying into budget conversations. The ecosystem has split into two businesses: establishing access, and monetising it. The report names the second tier LLM Mixers, illicit routing gateways that proxy, aggregate and resell unauthorised access to underground subscribers, and it describes open-source tooling used to build them, including new-api as a model hub and gateway, and gcli2api as a proxy that turns command-line tools into endpoints that look like frontier model APIs.

Jet Night is the case study with a price tag. One actor ran more than 500,000 API calls in under eight hours on stolen third-party keys and passed nearly one million dollars in token costs to the victim organisation, while selling unlimited access at about $60 a month. The researchers note that a consumer service level in that range would typically cost $100 to $250 a month, and that Jet Night has announced outages on its public Telegram channel, likely from keys being revoked as victims discover the theft.

“We believe the threat actor sells access to these tools via underground storefronts,” the researchers write of one cluster's gateway setup. The report documents the resale model through several incident examples. The public post provides no case count, sampling method or denominator, leaving prevalence and growth unmeasured.

The CVE-2026-40217 flaw moves the gateway into the blast radius

Model routing software is a privilege boundary. The report shows it becoming a privilege boundary worth attacking. After buying pre-validated virtual keys from the actor who had established access, a follow-on cluster exploited application logic in the victim's LiteLLM gateway, using a user ID rebind in the /key/regenerate endpoint, tracked as CVE-2026-40217, to lift a standard virtual key into full PROXY_ADMIN master credentials.

Every organisation that runs a shared gateway inherits that geometry. One key becomes every key, one proxy becomes the control point for every model the company can reach, and the gateway's release notes become security news. Patching a component that fronts production inference belongs on the same clock as patching an internet-facing web server, and the report's own remediation list puts gateway patch management in writing.

Detection works when enablement and spend become events

Here is the finding that changes a monitoring backlog. In multiple investigated incidents the model services had not been enabled at the time of compromise; abuse of stolen access keys let the actor modify and enable LLM APIs such as Bedrock and the Gemini API, and then generate a large bill in minutes. A change event on a model service is therefore a security event, and it is a cheap one to wire.

Log coverage decides whether the rest is visible. AWS exposes Bedrock activity in CloudTrail, including Converse, InvokeModel and InvokeModelWithResponseStream, and the report recommends treating attempts to alter invocation logging by a non-IaC principal as high severity. Azure covers Microsoft.CognitiveServices in Activity and Diagnostic logs. On Google Cloud, Gemini Enterprise Agent Platform inference operations are contained in Data Access audit logs, which are disabled by default because of volume and ingestion costs, so an operator has to configure IAM audit policies before the traffic exists to query.

The controls that change the exposure this quarter

Most of the remediation list is already in a cloud security baseline, which is the encouraging part. Phishing-resistant MFA on every identity provider and management console removes the session-token path that UNC6993 used. Least privilege, including an explicit deny on model services for accounts that have no reason to call them, removes the accidental grant. Granular key scopes per model and per environment stop a utility key from reaching a frontier model, and spend caps turn a runaway bill into an alert while the number is still small.

Take a concrete case. Consider this fictional example: a nine-person software team in Casablanca gave four developers long-lived provider keys in a shared .env, enabled a second model provider for an experiment in March, and never revoked either. Nobody in that team is doing anything wrong, and the configuration has three of the properties the report exploits: a key that cannot be attributed to a person, a service enabled outside change control, and no budget ceiling that anyone watches. Scanning repositories for those keys, scoping them per model, and putting model spend under the same alerting as cloud spend addresses those gaps. Those three steps sit inside the wider security audit and hardening checklist that the remediation section implies, and the door to close first is the one with no owner.

The report's outlook expects threat actors to increasingly prioritise LLMJacking, driven by the immediate, high-margin monetisation of emerging LLM Mixers. Read alongside the earlier AWS AI security framework, it makes the same point from the other direction. Defenders gain time by inventorying services, enabling the relevant logs and acting on the documented signals.

Sources

• The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources, Google Threat Intelligence Group, cloud.google.com, 2026-11-03
• AWS AI security framework: three layers, three phases, blog.neticslabs.com

Source: the Google Cloud Threat Intelligence post of 3 November 2026, read in full on 3 November 2026. The $100,000 daily figure, the $1 million cumulative figure, the UNC6993 account reference, the /api/create Ollama probe, the session-hijacking page, the max_tokens=1 validation sweeps, the new-api and gcli2api tooling, the Jet Night volume and pricing, CVE-2026-40217 and the /key/regenerate escalation, the enablement behaviour and the per-provider log names all come from that post. The Casablanca team example is illustrative and marked as such; the control ordering is Netics analysis.