Attackers Hijacked Companies' AI Access and Ran Up Bills as High as $1 Million, Mandiant Says

Mandiant and Google Threat Intelligence Group traced the hijackings to stolen cloud credentials and exposed keys, and found the stolen access resold to underground subscribers through gateways built for the purpose.

Hijacked AI access can produce a spike in fraudulent charges within hours, unlike cryptojacking, which drains resources slowly. A company’s AI budget assumes spending follows its own usage; here it follows whoever holds the key, and the charges can pile up before the compromise is detected.

Who pays when a key leaks?

The victim does. The usual way in was a stolen or exposed cloud identity token, such as a service account key or a GitHub access token, and the bills landed on organizations in financial services, retail, technology and transportation.

Some attackers went straight for AI keys. One group harvested corporate application programming interface (API) keys exposed in public GitHub repositories and tested each with a single-token request, a probe small enough to slip past volume alerts. In several incidents, the victim had not turned on an AI service at all; the stolen keys let the attackers switch it on.

What does an administrator key add?

In one intrusion, the group that stole the keys handed them to a second group, which attacked the victim’s LiteLLM gateway, the software that routes a company’s requests to AI models. A flaw in it turned ordinary keys into full administrator credentials. Administrator access gave the attackers deep, persistent control of the victim’s environment.

Who buys the stolen access?

Different crews do different jobs: one breaks in, and another runs what the teams call LLM Mixers, gateways that pool stolen credentials, meter usage and resell the access. One of them, a token routing service called Jet Night, drew on stolen keys for more than 500,000 AI calls in under eight hours. It passed nearly $1 million in token costs to the victim.

Jet Night sells an unlimited plan for about $60 a month with claimed access to frontier models, a level of service that would typically cost $100 to $250 a month. Google’s threat analysts believe the service stays profitable only because it runs on stolen keys. They did not name the victims or say how many organizations were hit.

What stops the bill?

The hardening steps the teams list include budget alerts, spending caps and per-model quotas on AI services; keys scoped so a credential for a basic model cannot call an expensive one; and a deny rule on AI services for any account that does not need them. Patching gateways such as LiteLLM is on the list too.

Which accounts in the company’s cloud could switch on an AI service nobody ordered, and who sees the first charge?