# Mandiant reports stolen AI access drove daily cloud charges above $100,000

_Published Monday, November 2, 2026 at 10:19 AM EST · Security, AI · Latest · Tier 2 — Notable_

![Mandiant reports stolen AI access drove daily cloud charges above $100,000 — Primary](https://storage.googleapis.com/gweb-cloudblog-publish/images/03_ThreatIntelligenceWebsiteBannerIdeas_BA.max-2600x2600.png)

Mandiant reported that attackers hijacking enterprise access to large language models generated fraudulent cloud charges exceeding $100,000 USD in a single day across individual incidents investigated in 2026. Cumulative charges at some organizations reached $1 million USD before access was revoked.

Attackers used stolen cloud credentials and exposed API keys to access models, enable services and resell access through gateways that pool credentials and route customer requests. The incidents affected financial services, retail, technology and transportation organizations across North America, South America and Asia Pacific.

In multiple investigated incidents, victims had not enabled model services before the compromise; attackers used stolen access to activate them and incur charges.

## Sources

- [Cloud Blog](https://cloud.google.com/blog/topics/threat-intelligence/llmjacking-monetizing-compromised-cloud-models/)

---
Canonical: https://techandbusiness.org/newswire/gQ2qbeX_nUL-bmSrM_3mnS
Published: 2026-11-02T15:19:53.397Z
Story chronology: 2026-11-02T00:00:00.000Z
Retrieved: 2026-11-02T17:40:13.994Z
Publisher: Tech & Business (techandbusiness.org)