AI Governance Institute
← News
Research2026-11-02

LLMJacking Costs Hit $100K Per Day as Criminal Ecosystem Matures

What happened

Google Mandiant incident responders published findings on LLMJacking. This is a financially motivated attack where criminals steal keys companies use to access external AI services. They then use those keys to run large AI workloads billed to the victim. The Token thieves costing companies $100K+ per day in illicit LLM charges report documents daily losses exceeding $100,000 and cumulative losses reaching $1 million per victim before discovery. Mandiant found that LLMJacking has developed a division of labor. Initial access brokers steal and sell credentials. A separate group called LLM Mixers routes stolen access through anonymizing layers to run AI workloads for paying customers. The scheme exploits the fact that AI access keys are often stored in code repositories and developer tools where they are easy to find but hard to monitor. Mandiant recommends least-privilege access controls, centralized secrets management, and automated scanning of code repositories for exposed credentials. This report follows a pattern of AI credential theft incidents, including the LiteLLM supply chain attack and the OpenCode breach that exposed API keys for multiple major AI providers.

Why it matters

  • ·AI access keys now carry direct financial liability. A single stolen key can generate $100,000 in unauthorized charges in one day. This makes key protection a financial controls issue, not only a security one.
  • ·The criminal ecosystem Mandiant describes is specialized and scalable, meaning credential theft is no longer opportunistic. Governance programs that do not monitor AI spend in near-real time will consistently discover losses through invoices rather than alerts.
  • ·Developers routinely embed AI access keys in shared code repositories and configuration files. This creates an exposure surface that most vendor due diligence programs and procurement controls do not currently assess.

Stay ahead of stories like this

Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Free every Thursday. Unsubscribe anytime.

Governance controls affected

SEC-004AI API Credential ManagementSEC-002AI System Access ControlsPRC-001AI Vendor Due DiligenceMON-004AI Output Anomaly DetectionIRC-001AI Incident Classification

What to do now

  • ☐Inventory every AI API key your organization holds, identify where each one is stored, and confirm no keys are embedded in code repositories or shared configuration files.
  • ☐Set up billing alerts with your AI providers so that spend crossing a defined daily threshold triggers an immediate notification to your security or finance team.
  • ☐Apply least-privilege scoping to AI API keys: each key should grant access only to the specific AI service and usage volume the associated team actually needs.
  • ☐Ask your engineering team to run an automated scan of your internal code repositories for exposed AI credentials, and establish a policy requiring that any discovered key be revoked and rotated within 24 hours.
  • ☐Review your AI vendor contracts to confirm whether the provider will flag or cap anomalous usage, and ask what notification process the vendor follows if it detects credential misuse on your account.

What to watch next

Compliance teams should monitor whether AI providers introduce mandatory spend-cap or anomaly-alert features in response to LLMJacking incidents, and whether those protections become a procurement requirement in enterprise contracts. The scale of documented losses may also attract attention from financial regulators and cyber insurers, who could begin treating AI credential controls as a coverage condition. The Nine AI Platform Breaches in October pattern suggests credential theft is accelerating. The 80,000 Proxy Servers Are Laundering Stolen AI Credentials report indicates the monetization infrastructure is already at industrial scale.

Related Coverage

Corporate Policy2026-11-01

Nine AI Platform Breaches in October Expose Credential Theft as a Systemic Risk

Cloud hosting provider Northflank disclosed on October 30, 2026 that attackers accessed and decrypted customer environment variables, including AI API keys stored on the platform. Wiz documented the incident as part of a broader pattern it calls 'Black October for AI Developer Platforms.' The pattern involved at least nine similar attacks on AI development platforms in October 2026. In each case, stolen credentials were used to run AI model queries at victims' expense, a technique Wiz calls LLMjacking.

Research2026-11-01

Patched ChatGPT Account Takeover Exposes Shared Session as an Access Risk

Security researchers at Parameter Labs discovered a chain of flaws in ChatGPT. The flaws allowed an attacker to take over any user's authenticated account. The attack required only sending the victim a shared conversation link. OpenAI rated the issue P1, its highest severity, and patched it on October 26, 2026. The incident exposes a governance gap: enterprises routinely share ChatGPT conversation links without treating that feature as an access control surface.

Research2026-10-28

Skynet Agent Hijacks Exposed AI Endpoints for 100,000-Step Attacks

Symantec researchers captured an autonomous offensive AI agent called Skynet that exploits unprotected AI model endpoints to conduct cyberattacks across up to 100,000 steps without human approval. The agent bypasses built-in safety controls using a layered jailbreak technique, then steals credentials, dumps databases, runs unauthorized code, and mines cryptocurrency on victim infrastructure. Attack costs, including charges for AI processing time, are shifted onto the compromised organization.