Mandiant says it responded to multiple incidents in 2026 in which threat actors hijacked enterprise access to large language models (LLMjacking), across several cloud and LLM providers and affecting organisations in North America, South America and Asia Pacific in financial services, retail, technology and transportation, Google said in a Google Cloud threat-intelligence post on 3 November 2026.

It says fraudulent charges exceeded US$100,000 in a single day in some incidents and reached US$1 million cumulatively at some organisations before access was revoked.

Google says the dominant initial access was exposed or stolen cloud identity tokens (IAM credentials, service account keys, GitHub personal access tokens and session tokens), and it shows a threat actor testing publicly exposed Ollama endpoints; some attackers then escalated privileges, created unauthorised IAM and backdoor service accounts and injected SSH keys into compute instances. In one case a follow-on cluster exploited a user ID rebind flaw in LiteLLM's /key/regenerate endpoint (CVE-2026-40217) to turn standard virtual keys into PROXY_ADMIN credentials.

Google says UNC6993 compromised a cloud instance through a misconfigured service account key and quickly ran up more than US$100,000 in charges, and Google Threat Intelligence Group (GTIG) describes stolen access being resold through 'LLM Mixers'; Google says another actor made more than 500,000 LLM API calls in under eight hours to power the jet-night.com routing service, passing nearly US$1 million in token costs to the victim. Google advises least privilege (denying access to cloud LLM services unless needed), API quotas and spending caps, phishing-resistant MFA, rapid patching of LLM gateways such as LiteLLM, and monitoring cloud audit and inference logs, including for max_tokens=1 credential-validation sweeps. (source: Google Cloud / GTIG and Mandiant) (secondary: BleepingComputer)