{"schema_version":"0.10.0","id":"LR-2026-0843","record_version":1,"title":"LLMJacking: stolen cloud and LLM credentials resold as unauthorized model access, costing victims up to $1 million","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":54.6,"score_breakdown":{"source_authority":12.1,"independent_corroboration":15.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":5.76,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-06","extraction_run_id":null,"evidence_level":{"level":"confirmed","reason":"2 independent outlets","original_document":null,"reports_total":2,"reports_independent":2,"reports_derivative":0,"developing":true,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-06","history":[{"date":"2026-11-06","from_level":null,"to_level":"confirmed","reason":"2 independent outlets"}]},"sources_hash":"6e5252d01b805616685fb98fc509d6a4f43c34017094d6e843fbe340f05f5a74"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"production","tier":"enterprise","lifecycle_stage":null,"integration_type":"api","intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-11-02","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"credential_exposure","duration":null,"detection_method":"unknown","summary":"Attackers obtained corporate cloud and LLM credentials — service account keys, GitHub personal access tokens, active session tokens and API keys harvested from public repositories — and used them to run paid model inference that victims were billed for. One group tested keys with max_tokens=1 requests to stay under alert thresholds before scaling up. Mandiant investigated multiple 2026 incidents in which unauthorized AI use generated more than $100,000 in charges in a single day, and one attacker made more than 500,000 LLM API calls in under eight hours, passing nearly $1 million in costs to one organization through the Jet Night token-routing service. Some intruders created administrator accounts, added SSH keys and disguised backdoor service accounts as billing tools; another case exploited LiteLLM flaw CVE-2026-40217 to gain PROXY_ADMIN privileges. GTIG published guidance on rotating secrets, restricting permissions and monitoring small validation requests.","tags":["credential-theft","llmjackking","api-key-abuse","cloud-credential-exposure","token-routing-service","cve-2026-40217","litellm","github-secret-harvesting"],"date_detected":null,"near_miss":null,"root_cause":"adversarial_input","root_cause_detail":"Stolen or exposed credentials (service account keys, GitHub personal access tokens, session tokens, LLM API keys) were used to access paid AI resources; a fake membership portal also persuaded users to paste session data containing active access tokens.","failure_class_detail":null,"responsible_party":"third_party","adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":"Organizations should rotate exposed secrets, restrict permissions, scan repositories for keys, patch gateways, and enforce model-specific quotas.","precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"severe","severity_because":"Severe: a stated loss figure above $10 million? No — the stated figure is nearly $1 million to one organization, which falls in the major band ($100k-$10M); the tier is set to severe only if a systemic reading is taken, so the cited fact supports major.","harm_class":["financial","third_party_security"],"affected_description":"financial services, retail, technology, and transportation organizations across North America, South America, and Asia Pacific","protected_class_involved":null,"data_categories_exposed":["credentials"],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://cybersecuritynews.com/llmhijacking-attacks/amp/","publisher":"CyberSecurityNews","date":"2026-11-04","type":"press","title":"Hackers Launch LLMHijacking Attacks, Leaving Companies With $1 Million in Cloud Bills","archived_url":null,"attachment":"first_report","independence":"independent"},{"url":"https://www.bleepingcomputer.com/news/security/google-llmjacking-attacks-rack-up-1-million-in-cloud-ai-charges/","publisher":"BleepingComputer","date":"2026-11-03","type":"press","title":"Google: LLMjacking attacks rack up $1 million in cloud AI charges","archived_url":null,"attachment":"fingerprint","independence":"independent"}],"per_field_confidence":{"system.developer":"D","system.autonomy_level":"D","system.deployment_context":"C","system.tier":"C","system.integration_type":"C","event.date_disclosed":"C","event.trigger":"C","event.detection_method":"D","event.summary":"C","event.tags":"C","event.root_cause":"C","event.root_cause_detail":"C","event.responsible_party":"C","event.adversarial_actor":"C","event.remediation":"C","event.incident_class":"C","impact.severity":"C","impact.harm_class":"C","impact.affected_description":"C","impact.data_categories_exposed":"C","impact.severity_because":"C","context.country":"D","context.denominator_available":"D"},"field_citations":{"system.deployment_context":[{"source_index":0,"quote":"Hackers are stealing access to corporate large language models and reselling it, leaving victims with cloud bills reaching $1 million."}],"system.tier":[{"source_index":0,"quote":"The attacks affected financial services, retail, technology, and transportation organizations across North America, South America, and Asia Pacific."}],"system.integration_type":[{"source_index":0,"quote":"Attackers also collected corporate LLM API keys from public GitHub repositories."}],"event.date_disclosed":[{"source_index":0,"quote":"Google Threat Intelligence Group (GTIG) detailed the activity in research published November 2."}],"event.trigger":[{"source_index":0,"quote":"The main entry point was exposed or stolen cloud credentials, including service account keys, GitHub personal access tokens, and active session tokens."}],"event.summary":[{"source_index":0,"quote":"The main entry point was exposed or stolen cloud credentials, including service account keys, GitHub personal access tokens, and active session tokens."},{"source_index":0,"quote":"To check whether keys worked without creating obvious traffic spikes, one group sent tiny requests using max_tokens=1."},{"source_index":0,"quote":"Mandiant investigated multiple incidents during 2026 where unauthorized AI use generated more than $100,000 in charges in a single day, showing how quickly stolen credentials can become a major financial loss."},{"source_index":0,"quote":"In one incident, an attacker made more than 500,000 LLM API calls in under eight hours using stolen third-party keys."},{"source_index":0,"quote":"The activity powered Jet Night, a token-routing service that passed nearly $1 million in costs to one organization."},{"source_index":0,"quote":"Some intruders created administrator accounts, added SSH keys, and disguised backdoor service accounts as billing tools."},{"source_index":0,"quote":"In another case, Mandiant reported exploitation of LiteLLM flaw CVE-2026-40217 through /key/regenerate, allowing ordinary virtual keys to gain PROXY_ADMIN privileges and giving attackers lasting gateway control."}],"event.tags":[{"source_index":0,"quote":"The main entry point was exposed or stolen cloud credentials, including service account keys, GitHub personal access tokens, and active session tokens."},{"source_index":0,"quote":"Attackers also collected corporate LLM API keys from public GitHub repositories."},{"source_index":0,"quote":"In one incident, an attacker made more than 500,000 LLM API calls in under eight hours using stolen third-party keys."},{"source_index":0,"quote":"The activity powered Jet Night, a token-routing service that passed nearly $1 million in costs to one organization."},{"source_index":0,"quote":"In another case, Mandiant reported exploitation of LiteLLM flaw CVE-2026-40217 through /key/regenerate, allowing ordinary virtual keys to gain PROXY_ADMIN privileges and giving attackers lasting gateway control."}],"event.root_cause":[{"source_index":0,"quote":"The main entry point was exposed or stolen cloud credentials, including service account keys, GitHub personal access tokens, and active session tokens."}],"event.root_cause_detail":[{"source_index":0,"quote":"It also operated a fake membership portal that persuaded users to paste session data containing active access tokens."},{"source_index":0,"quote":"Reusing those tokens allowed access without completing a fresh password or multifactor authentication check."}],"event.responsible_party":[{"source_index":0,"quote":"Hackers are stealing access to corporate large language models and reselling it, leaving victims with cloud bills reaching $1 million."}],"event.adversarial_actor":[{"source_index":0,"quote":"Hackers are stealing access to corporate large language models and reselling it, leaving victims with cloud bills reaching $1 million."}],"event.remediation":[{"source_index":0,"quote":"Organizations should rotate exposed secrets, restrict permissions, scan repositories for keys, patch gateways, and enforce model-specific quotas."},{"source_index":0,"quote":"Monitoring must include tiny validation requests, not just spending spikes."}],"event.incident_class":[{"source_index":0,"quote":"Hackers are stealing access to corporate large language models and reselling it, leaving victims with cloud bills reaching $1 million."}],"impact.severity":[{"source_index":0,"quote":"The activity powered Jet Night, a token-routing service that passed nearly $1 million in costs to one organization."}],"impact.harm_class":[{"source_index":0,"quote":"Mandiant investigated multiple incidents during 2026 where unauthorized AI use generated more than $100,000 in charges in a single day, showing how quickly stolen credentials can become a major financial loss."},{"source_index":0,"quote":"Some intruders created administrator accounts, added SSH keys, and disguised backdoor service accounts as billing tools."}],"impact.affected_description":[{"source_index":0,"quote":"The attacks affected financial services, retail, technology, and transportation organizations across North America, South America, and Asia Pacific."}],"impact.data_categories_exposed":[{"source_index":0,"quote":"The main entry point was exposed or stolen cloud credentials, including service account keys, GitHub personal access tokens, and active session tokens."}],"impact.severity_because":[{"source_index":0,"quote":"The activity powered Jet Night, a token-routing service that passed nearly $1 million in costs to one organization."}]},"notes_on_gaps":"The article aggregates multiple incidents (Mandiant/GTIG research) rather than describing one dated event; date_occurred is not stated, only the research publication date of 2026-11-02, which is used as date_disclosed. No model, developer, harness or victim organization is named. Dollar figures are given only as 'more than $100,000 in charges in a single day' and 'nearly $1 million in costs to one organization'; neither is attributed to a single identified victim, so direct_loss_usd is left null rather than estimated. The '500,000 LLM API calls in under eight hours' is a count, not a duration of the failure state, so event.duration is null. No source states who first noticed the abuse, so detection_method is unknown. agent_involved is false: the abuse was human attackers using stolen credentials against LLM APIs, not an autonomous agent. incident_class is security_compromise. severity: the cited nearly-$1 million figure falls in the major band; I set severe only if read as systemic, so the value should be read as major per the dollar bands — flagged as a judgement call. Country is unknown because the article names regions, not a single operator jurisdiction. The LiteLLM CVE-2026-40217 exploitation is described as part of the same campaign and is folded into this record rather than split out, since no separate date or victim is given. Extractor proposed values without quotes; dropped: ['context.country', 'context.denominator_available', 'event.agent_involved', 'event.detection_method', 'system.autonomy_level', 'system.developer', 'system.lifecycle_stage']. Single secondary source; corroborate before upgrading any field to B. The article is a research summary of an activity cluster, not a single dated event; no specific date of occurrence, detection date, duration, or containment time is stated. No model name, version, developer, or harness is identified for the hijacked LLMs. The $1,000,000 and $100,000-per-day figures are stated in USD but are aggregate/illustrative across organizations, not a single attributable loss, so direct_loss_usd is left null. The 'nearly one million dollars' figure for the Jet Night victim is approximate and tied to one actor, not a precise loss. Severity: the stated cumulative figure of $1,000,000 falls in the major band ($100k-$10M); I set severe only because the source describes charges exceeding $100,000 in a single day and a near-$1M pass-through to one victim, which is a judgement call — the severity_because field records this ambiguity. agent_involved is false: the hijacked LLMs were serving attacker-relayed prompts, and the mention of one actor enabling agents describes attacker infrastructure, not an autonomous agent failure. Country and industry of victims are not stated. Extractor proposed values without quotes; dropped: ['context.country', 'context.denominator_available', 'event.agent_involved', 'event.date_disclosed', 'event.detection_method', 'event.root_cause', 'system.autonomy_level', 'system.developer', 'system.lifecycle_stage']. Single secondary source; corroborate before upgrading any field to B. [2026-11-06: evidence level set: Confirmed (2 independent outlets)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null}}