Cases › security breach › LR-2026-0843

LLMJacking: stolen cloud and LLM credentials resold as unauthorized model access, costing victims up to $1 million

Confirmed Why: 2 independent outlets · 2 independent reports

Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.

Status: advice only, no fix reported

Severity severe

Reported 2 Nov 2026

No source states: money lost or records count, developer and model, could do, deployer, industry.

Severity severe: a stated loss figure above $10 million? No — the stated figure is nearly $1 million to one organization, which falls in the major band ($100k-$10M); the tier is set to severe only if a systemic reading is taken, so the cited fact supports major.

Attackers obtained corporate cloud and LLM credentials — service account keys, GitHub personal access tokens, active session tokens and API keys harvested from public repositories — and used them to run paid model inference that victims were billed for. One group tested keys with max_tokens=1 requests to stay under alert thresholds before scaling up. Mandiant investigated multiple 2026 incidents in which unauthorized AI use generated more than $100,000 in charges in a single day, and one attacker made more than 500,000 LLM API calls in under eight hours, passing nearly $1 million in costs to one organization through the Jet Night token-routing service. Some intruders created administrator accounts, added SSH keys and disguised backdoor service accounts as billing tools; another case exploited LiteLLM flaw CVE-2026-40217 to gain PROXY_ADMIN privileges. GTIG published guidance on rotating secrets, restricting permissions and monitoring small validation requests.

What happened

No source tells the story step by step yet.

What was done

Advice in source, not a fix by the party

“Organizations should rotate exposed secrets, restrict permissions, scan repositories for keys, patch gateways, and enforce model-specific quotas.”

Short-lived, scoped credentials Vulnerability scanning of AI components

Risks

Credential and privilege abuse
Primary42 incidents

AI used to run a cyber attack
Also103 incidents
Rising: 25 vs 4.2 a week

AI system attacked or breached
Also19 incidents

Sorted by rule from the case's fields; not yet read from the sources.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Application

Short-lived, scoped credentials · Secrets kept out of the model's context · Separate identity for each agent · Least-privilege access for the agent · Alerts on unusual tool use · Activity logs · Sensitive-data checks on outbound data

Infrastructure / target

Multi-factor sign-in and password policy · Secrets scanning

Evidence

Cause hostile input carried instructions
What set it off exposed credentials
What was done Organizations should rotate exposed secrets, restrict permissions, scan repositories for keys, patch gateways, and enforce model-specific quotas.

No source states: a step-by-step account, when it happened, when it was found, how many records were exposed, a count of the other parties affected, any court case.

Show every field, with its source and grade