syslog.eu
CS EN DE FR
[WARNING · CHECK THIS WEEK]/News·

Stolen AI and cloud keys ran up over $100,000 in one day: find and rotate yours

Google Threat Intelligence Group and Mandiant reported on 2 November 2026 that criminals hijack companies' access to AI models ("LLMJacking"). In incidents Mandiant handled this year, fraudulent charges topped $100,000 within one day and reached $1 million at some organisations before access was cut. The usual way in was exposed or stolen cloud credentials.

Affected github litellm llm-api ollama
Syslog card, level WARNING (check this week): $1M billed at some firms, Google: over $100,000 in a single day. Affected: Cloud AI APIs, GitHub, LiteLLM, Ollama. To do: Scan repos for exposed AI and cloud keys; Revoke and rotate every key you find.

Does this concern you?

  • Affected: any company with API keys for AI models or a cloud service, or billing enabled on a cloud project, including keys a colleague made to try something out, GitHub personal access tokens and service-account keys; also anyone with an internet-reachable Ollama server or a LiteLLM gateway.
  • Skip it if: you have no AI or cloud API keys and no cloud billing account.

What to do

  • Search your repositories, public GitHub ones first, for AI and cloud API keys; revoke and replace each one you find.
  • Keep keys in one secrets manager with automatic rotation; give users and service accounts only the access they need.
  • Turn on automatic secrets scanning in repositories.
  • Do not leave an Ollama or other model endpoint reachable from the internet without protection.
  • If you run LiteLLM: update it (no source names a fixed version) and check which keys hold PROXY_ADMIN rights.
  • Signs you are already hit: API keys or service accounts nobody on your side created (one group disguised service accounts as billing tools), AI services or pay-as-you-go plans switched on in your cloud projects, SSH keys you do not recognise on virtual machines, and a sudden jump in API calls or charges. Revoke or remove them.

What we know – and what we don't

  • Mandiant says the incidents spanned several cloud and LLM providers and sectors from finance to transportation.
  • One actor checked harvested keys with single-token requests (max_tokens=1), staying under the volume alerts of EDR and SIEM tools.
  • Another made over 500,000 API calls in under eight hours for Jet Night, a resale service; Google says the victim was left with nearly $1 million in token costs.
  • The group Google tracks as UNC6993 ran a fake application portal that got users to paste an active access token, which bypassed password and MFA checks.
  • Google says a second group turned LiteLLM virtual keys into PROXY_ADMIN keys via a flaw in /key/regenerate (CVE-2026-40217). The CVE record under that number describes a different flaw: code execution via /guardrails/test_custom_code through 2026-04-08. CISA does not list it as exploited.
  • Neither article names the providers or says how many organisations were hit.

Why it matters

Nothing has to break for this to hurt. A leaked key simply spends your money, in hours, not gradually as cryptojacking did, and Google expects criminals to favour it. The bill arrives at the end of the month; the attacker starts the day the key leaks.

Sources

← All news