Mandiant reports stolen AI access drove daily cloud charges above $100,000

Mandiant reported that attackers hijacking enterprise access to large language models generated fraudulent cloud charges exceeding $100,000 USD in a single day across individual incidents investigated in 2026. Cumulative charges at some organizations reached $1 million USD before access was revoked. Attackers used stolen cloud credentials and exposed API keys to access models, enable services and resell access through gateways that pool credentials and route customer requests. The incidents affected financial services, retail, technology and transportation organizations across North America, South America and Asia Pacific. In multiple investigated incidents, victims had not enabled model services before the compromise; attackers used stolen access to activate them and incur charges.