Technology news and discussion on TalkFuse.
Token thieves costing companies $100K+ per day in illicit LLM charges
Criminals are stealing companies’ access tokens and API keys to run large volumes of requests against paid AI models, leaving victims with bills that can exceed $100,000 a day. Google’s Mandiant responders say this practice, known as LLMJacking, is growing and gives attackers access to computing resources that can also support wider automated attacks.
In one case, attackers used stolen cloud access to create API keys and enable services, generating $100,000 in charges; other incidents involved more than 500,000 API calls in under eight hours. Google also linked stolen keys to Jet Night, a token-routing service offering an unlimited plan for about US$60 a month, below the typical US$100–250 price range cited for comparable access. Google recommends stronger identity and access controls, key rotation and limiting permissions to what users and service accounts need.
In short
- Stolen AI access can cost companies over $100,000 a day.
- Attackers are using stolen keys to run huge volumes of model requests.
- Google recommends tighter access controls and regular key rotation.
Steelman: both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
Companies and cloud providers have a strong interest in tightening identity checks, limiting permissions and rotating exposed keys: stolen credentials can generate enormous costs quickly and provide computing capacity for further attacks. Because services can be enabled and keys created through compromised access, preventative controls may reduce both financial harm and the attackers’ ability to scale abuse.
The case against
Stricter controls can add friction and administrative work for legitimate developers and businesses that rely on fast, flexible access to AI services. Providers should therefore make safeguards practical and proportionate, while also improving monitoring and response; otherwise, the burden of preventing and containing abuse may fall too heavily on customers.
Explained simply
Large language models are AI systems that generate text, analyse information or help with tasks in response to requests. Companies often access them through cloud services, using digital keys or tokens that identify the account and allow software to make requests; usage can incur charges.
If criminals steal those credentials, they can use the victim’s account and computing capacity without permission. High volumes of requests can quickly run up costs, while the same access may help automate other activity. The issue matters to businesses because weakly protected or overly broad credentials can expose both their budgets and cloud services.