Attackers hijack corporate AI model access, running up cloud bills of up to $1 million
- Severity
- High
- Sources
- 1
What happened
GTIG and Mandiant report LLMJacking campaigns across financial services, retail, technology and transportation, with some incidents exceeding $100,000 in a single day. Initial access came from exposed or stolen service account keys, GitHub personal access tokens, session tokens harvested by a fake membership portal run by UNC6993, and LLM API keys scraped from public GitHub repositories. Attackers validated keys with maxtokens=1 requests and exploited LiteLLM flaw CVE-2026-40217 via /key/regenerate to gain PROXYADMIN from ordinary virtual keys. Defenders should rotate exposed secrets, scan repositories, patch gateways, enforce model quotas, hunt for tiny validation requests and unexpected AI service activation, and check for replacement accounts and SSH keys.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Rotate any exposed cloud credentials, service account keys, API keys and GitHub tokens.
- Scan repositories and secret managers for leaked keys and passwords.
- Investigate unexpected AI service activation, new access keys, and unusual model requests.
- Patch LiteLLM gateways against CVE-2026-40217 and enforce model-specific quotas.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Who and what is in it
Threat actors
Products