What happened
On 2 November 2026, GTIG and Mandiant published their investigation into multiple LLMJacking incidents. On 3 November 2026, BleepingComputer reported the disclosed financial impact and LLM mixer operating model. GTIG and Mandiant observed fraudulent LLM consumption charges exceeding USD 100,000 in a single day, with cumulative charges at some organisations reaching USD 1 million before access was revoked. The incidents affected organisations in North America, South America and Asia-Pacific across financial services, retail, technology and transportation.
The dominant initial-access material included IAM credentials, service-account keys, GitHub personal access tokens, active session tokens and LLM API keys. In mid-2026, UNC6993 compromised a cloud instance through a misconfigured service-account key and used the access to grant further access to an LLM API. Observed validation activity included calls to the Ollama /api/create endpoint and minimal model requests using max_tokens=1. GTIG says the low-volume requests helped test whether stolen credentials remained usable before high-volume abuse began.
GTIG observed exploitation of CVE-2026-40217 through LiteLLM’s /key/regenerate endpoint to elevate standard Virtual Keys into PROXY_ADMIN master credentials. Other persistence included unauthorised IAM and service accounts, administrative policy attachment and SSH-key injection into compute metadata. This means the incident can survive simple API-key revocation if secondary identities, temporary credentials or host-level access remain.
One threat actor deployed the Manus agent framework with SearXNG and agent-infra/sandbox environments and exposed multi-model endpoints under the D1337-KAIROS persona. One actor executed more than 500,000 LLM API calls in less than eight hours through jet-night.com, passing nearly USD 1 million in token costs to the victim organisation. GTIG published jet-night.com and newapi.pro as network indicators for LLM mixer infrastructure. Attribution posture: GTIG tracks multiple financially motivated clusters, including UNC6993, but does not attribute the whole LLMJacking ecosystem to one actor or state.
Why this matters now
LLMJacking changes cloud resource theft from a gradual compute problem into a fast financial and identity incident. Stolen service-account keys, personal access tokens, federation credentials or session tokens can enable services that were previously disabled, create new keys and generate high-volume inference costs before conventional endpoint alerts detect anything unusual.
The exposed organisations span financial services, retail, technology and transportation across several regions. Any enterprise adopting managed foundation models, self-hosted model endpoints, LiteLLM or similar gateways, agent sandboxes or GPU workloads inherits the same requirement: know which identity can enable a model, raise quota, create credentials, expose an endpoint and accept the resulting bill.
Security and FinOps ownership must converge. Budget alerts without identity telemetry may detect loss after access is monetised, while identity controls without inference and billing logs may miss legitimate-looking API consumption. The incident threshold should therefore combine unauthorised service enablement, key creation, model usage, rate anomalies and financial exposure.
The decision for security leaders
Define unauthorised model enablement or quota expansion as a security incident, not merely a cloud-billing anomaly. The response owner should include cloud security, identity, FinOps, application owners and legal where compromised infrastructure also exposed repositories, databases or secret managers.
Apply least privilege to the ability to enable LLM services, create model deployments, raise quotas and generate service-account keys. Separate model consumption identities by environment and workload so a key used by a basic application cannot invoke premium frontier models or create durable administrative access.
Require inference, control-plane and billing telemetry to converge in one response workflow. A valid API call can still represent theft; closure requires proving the requesting identity, service enablement, model, volume, source infrastructure and associated spend were authorised.
Evidence of closure
- Billing telemetry proves alerts activate before the approved daily loss tolerance is exceeded.
- Cloud audit logs show no unauthorised AI service enablement or credential creation.
- External testing finds no publicly reachable Ollama or model-gateway management endpoints.
- Credential inventory confirms rotation and least privilege for service accounts, personal-access tokens and federation tokens.LiteLLM review confirms no unauthorised PROXY_ADMIN credentials or /key/regenerate abuse.Identity-graph validation confirms compromised keys cannot create fresh access ke.
The Security.io assessment
The research describes a functioning criminal market rather than isolated experimentation. Initial-access operators steal cloud or model credentials, while LLM mixers aggregate and resell access. This division of labour can make apparently unrelated usage across different providers part of the same monetisation chain and increases the value of even narrowly scoped model credentials.
GTIG observed a containerised backdoor using the Manus agent framework, supported by SearXNG and agent-infra/sandbox environments. The cited sources do not identify the upstream LLM model or version used by the Manus-based backdoor. The operator configured publicly accessible reverse proxies, custom Node.js relays, short-lived service accounts and multi-model routing under the D1337-KAIROS persona. The Manus-based backdoor queried an upstream LLM to reason over instructions and executed resulting commands locally in the compromised cloud environment.
The cited sources did not publish victim names, a total victim count or a provider-by-provider allocation of the disclosed financial losses. The financial impact is based on Mandiant’s direct incident work, but organisations should not infer prevalence from unnamed cases. The practical conclusion is narrower and well supported: exposed cloud identities can create rapid AI charges, persistence and secondary credential theft before endpoint-centric controls respond.
Questions for the morning meeting
- Which teams can enable premium LLM services or increase quotas?
- Can one service-account key generate fresh credentials or bypass MFA?
- At what spending threshold does AI usage become a security incident?
- Are model gateways and Ollama endpoints in the external attack-surface inventory?