Attackers hijack corporate AI model access, running up cloud bills of up to $1 million
AI SECURITYUNC6993redteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
Google Threat Intelligence Group and Mandiant describe LLMJacking, where attackers abuse stolen cloud credentials, GitHub tokens and session tokens to run unauthorised calls against corporate large language models. In one incident, over 500,000 API calls were made in under eight hours through a token-routing service called Jet Night, costing one organisation nearly $1 million. Attackers also used tiny test requests to avoid triggering alerts and created admin accounts and backdoors, so monitoring for billing spikes alone is not enough.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Rotate any exposed cloud credentials, service account keys, API keys and GitHub tokens.
- Scan repositories and secret managers for leaked keys and passwords.
- Investigate unexpected AI service activation, new access keys, and unusual model requests.
- Patch LiteLLM gateways against CVE-2026-40217 and enforce model-specific quotas.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Cyber Security News
Who and what is in it
Threat actors
Products