Summary
- Some LLMjacking incidents generated more than $100,000 in daily charges.
- Criminal intermediaries resold model access obtained through compromised credentials.
- Usage limits and identity monitoring can expose abnormal AI consumption.
Attackers using compromised enterprise access to artificial intelligence services have generated fraudulent charges exceeding $100,000 in a single day, with cumulative model usage bills reaching $1 million at some affected organisations.
The findings come from incident investigations by Mandiant, part of Google Cloud, which identified a growing market for unauthorised use and resale of commercial large language model capacity.
The activity is described as LLMjacking. Criminal operators obtain access to resources billed to another organisation, then consume model capacity directly or route requests through services that sell that capacity to other customers.
Mandiant investigated incidents involving multiple providers during 2026, including organisations in finance, retail, technology, and transport. Its identified cases covered several regions outside Europe, but the same cloud and API architectures are used by multinational businesses.
The reported sums represent fraudulent usage charges accrued through the compromised access. They should not automatically be described as final financial losses, because billing disputes, provider adjustments, or recovery arrangements may change what an affected organisation ultimately pays.
The mechanism differs from conventional cryptojacking. Rather than using stolen processing capacity to mine cryptocurrency, LLMjacking consumes inference services for which a provider charges according to model type, request volume, and other usage metrics.
High-volume requests to expensive models can therefore create substantial costs before the legitimate customer notices a change in consumption. A compromised credential may be sufficient when it has broad access to a chargeable service.
Investigators also identified a separation between criminals obtaining access and those monetising it. Some actors focused on compromised cloud environments or API keys, while others operated gateways through which customers could purchase otherwise unauthorised model access.
Mandiant describes the latter as LLM Mixers. The gateway operator can route a request to a model paid for by an unrelated organisation, concealing the origin of the consumption from the person benefiting from it.
Such arrangements resemble established criminal markets for access to compromised infrastructure, where initial intrusion and final exploitation are distinct services. AI model capacity becomes the commodity being resold.
Enterprise deployments commonly use service accounts and API keys to allow applications to call AI models without manual authentication for every request. Those credentials may be stored in development platforms, cloud environments, software configuration, or automation pipelines.
The number of applications connecting to commercial AI systems is growing, increasing the importance of knowing which machine identity is responsible for a request and who is authorised to modify its access.
An attacker does not need to obtain access to a company’s entire data estate to generate a substantial bill. A narrowly scoped compromise can have serious financial effects where the affected identity is allowed to consume expensive model services without effective limits.
Monitoring becomes an intersection of cybersecurity and financial governance. Unexpected request volumes, unusual models, unfamiliar geographical patterns, and rapid changes in consumption may reveal problems that traditional malware alerts do not detect.
Usage thresholds and spending alerts can provide additional visibility, although their effectiveness depends on how quickly information reaches people able to suspend credentials or restrict access.
The use of cloud intermediaries complicates responsibility. An application provider may hold credentials while another organisation receives the invoice, leaving several parties involved in investigating the source of abnormal consumption.
Security programmes often discuss AI governance in terms of sensitive data, harmful outputs, and model behaviour. Mandiant’s cases demonstrate that access control and consumption monitoring are also necessary to protect budgets against criminal misuse.
The documented investigations establish substantial fraudulent AI charges and a market for reselling compromised model access. They do not show that every affected organisation suffered an irreversible loss equal to the full amount billed.
As commercial AI services become embedded in enterprise software, the scale of automated requests makes model access a financially valuable target in its own right.
