Introduction
I have spent years telling developers the same thing about secrets: your API key is a credit card with no spending limit and no fraud department. This week, Google put a number on what happens when that advice gets ignored. On November 2, 2026, Google's Threat Intelligence Group and Mandiant published "The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources," and the numbers make you sit up straight: fraudulent charges above $100,000 in a single day at individual victims, and cumulative charges reaching roughly $1 million before anyone revoked the stolen access.
LLMjacking is the theft of a business's paid access to large language models. Attackers get hold of a cloud identity or an AI API key, spend the victim's money running expensive models, and resell that access through storefronts that look, to a buyer, like a cheap AI subscription. One reseller, Jet Night, ran more than 500,000 model calls in under eight hours on stolen keys and passed nearly $1 million in token costs to a single victim — while charging its own subscribers about $60 a month.
If you run a website, build with AI tools, or keep an AI key anywhere near your code, this story is about you. And the break-in is ordinary: nobody jailbroke a model or found a zero-day. They found a key in a public GitHub repo, a misconfigured service account, or a token pasted into a fake login page. The boring stuff — the stuff we all keep meaning to fix.
What LLMjacking Actually Is
Every AI feature shipped in the last two years runs on the same deal: you pay per token. That billing runs through an API key or a cloud service account, and whoever holds that key can spend your money as fast as the model can generate words.
LLMjacking is what happens when someone else holds your key. The attacker does not need your password or your laptop — one credential is enough to burn through frontier-model inference. Mandiant describes a division of labour that looks less like hacking and more like a small business: initial-access operators steal the credentials, and "LLM Mixers" — gateways that pool stolen keys and resell the access — handle the customers.
Cryptojacking, the older cousin of this attack, took months to show up on a cloud bill, because mining is slow and the charges creep up. LLMjacking takes an afternoon. A frontier model can chew through $100,000 of tokens in a single day. Speed is the whole business model: steal, spend, resell, repeat, before anyone notices the meter running.
The Numbers Google Put on It
Mandiant responded to several of these incidents across 2026, at organizations in financial services, retail, technology, and transportation, spread across North America, South America, and Asia Pacific. The report gives no total victim count or market-wide loss figure — these are per-case numbers, not averages. But the per-case numbers are bad enough on their own.
In individual incidents, fraudulent charges passed $100,000 in a single day. At some organizations, cumulative charges reached roughly $1 million before access was revoked. The best-documented case is Jet Night: more than 500,000 LLM API calls in under eight hours, nearly $1 million in token costs passed to one victim organization, while Jet Night sold "unlimited" access for about $60 a month. Google estimates comparable legitimate access costs roughly $100 to $250 a month.
Google names two mixers in the report's indicator table — jet-night.com and newapi.pro — routing gateways that proxy, aggregate, and resell unauthorized model access through storefronts with pricing pages. Someone built a subscription business on top of other people's API keys, and it worked well enough to burn a million dollars of someone else's tokens in a single workday.
How They Get In: The Boring Ways
The report's attack paths are embarrassing in their simplicity — and that is exactly why they work at scale.
The first route is the one every developer has been warned about a hundred times: keys in public code. Attackers harvest LLM API keys and cloud service account keys from public GitHub repositories, then test them quietly with single-token requests — max_tokens set to 1 — so usage stays under whatever alert threshold the victim has set. A key that works gets pooled with others and handed to a mixer.
The second route is cloud identity theft. The report tracks one cluster, UNC6993, that got in through a misconfigured service account key on a cloud instance. Once inside, the group ran a fake portal that asked users to paste a raw access token — a trick that gets past both password and multi-factor authentication, because the victim hands over a live session token directly. With that access, UNC6993 did not just use the keys it found: it created more API keys and switched on AI services the victim had never used, running up more than $100,000 in charges.
The third route is through the tools themselves. The report lists CVE-2026-40217, a flaw in LiteLLM's key regeneration endpoint, where a user ID rebind issue could turn an ordinary virtual key into a PROXY_ADMIN master credential. LiteLLM is the open-source gateway many teams use to route requests to multiple model providers behind one API — compromise the gateway, and you inherit every key behind it. Reported targets include Amazon Bedrock, Azure AI services, the Gemini API, and publicly exposed Ollama endpoints.
Why This Hits WordPress and Web Developers Too
You might think you do not run a big enterprise AI deployment, so this is someone else's problem. It is not, because AI has quietly moved into the ordinary web stack. If you run a WordPress site with an AI chatbot plugin, an AI content writer, an AI image generator, or an AI support assistant, there is an API key somewhere in your setup — in wp-config.php, in a plugin's settings, in an environment file on your server, or in a deploy script. If you built a small SaaS or a client project that calls a model, there is a key in that codebase.
Every one of those keys is a target now, because the mixers need a constant supply. A single leaked key from a small agency's side project will not produce a million-dollar bill on its own, but it does not need to: the mixers pool hundreds of keys, and your key is worth real money to them the moment it works. And the bill lands on you, not on them. There is no fraud department for API keys. Your provider will just bill you — from their side the requests came from your key and looked entirely legitimate.
Small teams usually find out late. The big enterprises in Mandiant's report found out through billing alerts and security teams. A freelancer or a small agency finds out when the card gets declined, when the monthly invoice arrives, or when the key stops working because the provider suspended the account. By then the damage is done.
What Google Says Actually Works
The good news is that the defenses are not exotic. They are the same boring controls security people have recommended for years, and the report is specific about which ones matter here.
First, set spending limits and billing alerts, and set them low. A hard cap and an alert at a threshold you would actually notice are the single most effective controls against LLMjacking, because the attack depends on spending fast before anyone looks. If your monthly AI bill is normally $200, an alert at $500 and a hard cap at $1,000 turns a million-dollar incident into an embarrassing afternoon. Most providers support budgets and quotas — turn them on.
Second, scope your keys and keep them short-lived. A key that can only call one model, from one IP range, with a low rate limit, is worth far less to a thief than a master key with no restrictions. Rotate keys regularly, and immediately if one may have been exposed.
Third, scan for secrets and stop them leaving. Use secret scanning with push protection on your repositories so a key can never be committed in the first place, and audit your existing repos and deployment history for keys already out there. The report's most common entry point was a key sitting in public code, waiting to be found.
Fourth, watch for signs someone else is spending your money. Check your cloud console for services you never enabled — Bedrock, Gemini, or Azure AI services switched on without your knowledge are a red flag. Check for API keys you did not create, and for usage at hours when nobody on your team works. If you run a gateway like LiteLLM, patch it and audit who holds admin keys.
Finally, keep keys out of the places attackers look. Use your provider's secret manager or your platform's environment variables instead of a config file, never commit a .env file, and never store a production key on a laptop that also holds your deployment access.
What I Would Do This Week
If you use AI APIs anywhere — and in late 2026, almost every working developer does — here is the short list I would work through this week, in order.
First, open your provider's billing dashboard and set a budget cap and an alert. Do this before anything else, because it is the only control that limits the damage while you are still figuring out the rest.
Second, list every AI API key your team holds, where each one lives, and what it can access. If that list surprises you, that is the finding. Rotate anything that has ever been pasted into a chat, a shared doc, or a public repo, and delete the keys you no longer use.
Third, turn on secret scanning with push protection on every repository, and scan your existing history. GitHub's own secret scanning is free for public repos — there is no reason left to skip it.
Fourth, check your cloud accounts for services and keys you did not create — especially AI services that are enabled but nobody on your team remembers enabling.
And fifth, if you run an LLM gateway or a self-hosted model endpoint like Ollama, make sure it is not reachable from the public internet without authentication. An exposed Ollama endpoint was one of the reported targets.
Conclusion
LLMjacking is not a sophisticated attack, and that is what makes it dangerous. It needs no zero-day, no jailbreak, no genius. It needs a key left in a public repo, a service account never locked down, or a token pasted into a page that should never have been trusted — and then a few hours of nobody watching the billing dashboard. Google and Mandiant have now documented the business behind it: stolen keys pooled by mixers and resold for $60 a month.
The fix is not a new product. It is a spending cap, a scoped key, a secret scan, and a habit of looking at the bill. Go and check your keys. The mixers already have.
FAQ
What is LLMjacking?
LLMjacking is the theft of a business's paid access to large language models. Attackers steal cloud credentials or AI API keys, run expensive models on the victim's account, and resell that access through illicit gateways called LLM Mixers.
How much money have LLMjacking victims lost?
According to Google's Threat Intelligence Group and Mandiant, fraudulent charges passed $100,000 in a single day at individual victims, and cumulative charges reached roughly $1 million at some organizations before access was revoked. In one case, a reseller called Jet Night ran more than 500,000 API calls in under eight hours and passed nearly $1 million in token costs to a single victim.
How do attackers steal AI API keys?
The most common routes in the report are keys harvested from public GitHub repositories, misconfigured or stolen cloud service account keys, phishing pages that trick users into pasting raw session tokens, and flaws in AI gateways such as the LiteLLM key-regeneration issue (CVE-2026-40217).
What are LLM Mixers, and what is Jet Night?
LLM Mixers are gateways that pool stolen API keys and resell unauthorized model access to subscribers. Jet Night is one such service named in the report: it sold "unlimited" access for about $60 a month while running its calls on stolen keys, compared with roughly $100 to $250 a month for comparable legitimate access.
Does LLMjacking affect small developers and WordPress site owners?
Yes. Any site or project that calls an AI API holds a key — in a plugin, a config file, a deploy script, or a developer's laptop — and mixers pool keys from victims of all sizes. Small teams often discover the theft late, when the invoice arrives or the key stops working.
What should I do right now to protect my AI API keys?
Set a spending cap and a billing alert on every AI provider account, scope each key to the minimum it needs, rotate keys that may have been exposed, turn on secret scanning with push protection on your repositories, and check your cloud accounts for AI services or keys you did not create.
