MisuseSerious1 sourceFirst seen
Thieves Rent Out Stolen AI Keys, Victims Get the Bill
Ourtake
Nothing says enterprise AI adoption like a seven-figure invoice for a stranger's chatbot habit.
What happened
Google's Threat Intelligence Group and Mandiant describe LLMjacking attacks in which attackers steal or scan for LLM API keys and resell access through proxy services. Some victim organizations were charged over $100,000 in a single day and up to $1,000,000 cumulatively, and the researchers note the attacks grew during 2026.