Overview
- Google Threat Intelligence Group and Mandiant warned Tuesday that multiple 2026 incidents produced sudden billing spikes exceeding $100,000 in a day and in some cases nearly $1 million before access was revoked.
- Attackers gain entry by stealing API keys, cloud identity tokens, GitHub and service-account keys, then escalate privileges and harvest more credentials inside corporate cloud environments.
- Researchers documented exploitation of model-routing middleware, including CVE-2026-40217 in a LiteLLM gateway, which let intruders elevate ordinary keys and maintain access or install backdoors.
- A growing criminal ecosystem has split roles so initial-access operators sell stolen access to 'LLM Mixers' such as Jet Night and newapi.pro, which proxy and resell model use to paying subscribers at far lower prices than legitimate plans.
- Defenders are urged to monitor AI service state and usage quotas, enforce least-privilege IAM, scan for exposed secrets, revoke compromised keys quickly, and patch routing gateways because analysts expect LLMJacking to increase and cause steep, immediate financial and data risks.