Threat actors stole LLM access in 2026, draining over $100,000
The Google Threat Intelligence Group reported 2026 incidents where threat actors hijacked enterprise access to Large Language Models, generating fraudulent cloud charges exceeding $100,000 USD per day. Cumulative charges across incidents reached nearly $1 million.
- Field
- computer security
- What they did
- Researchers described a method for stealing AI API keys, which allows attackers to deceive cloud providers and charge hundreds of thousands of dollars for resource usage.
- Why it matters
- This allows companies in the financial sector and other industries to avoid financial losses by detecting and blocking such attacks on corporate accounts.
#llm#api security#threat intelligence#cloud fraud#mandiant



