Token thieves costing companies $100K+ per day in illicit LLM charges

Corporate organizations are suffering significant financial losses due to criminals illicitly accessing and abusing their Large Language Model (LLM) services. The unauthorized consumption of computing resources and AI services can result in daily charges exceeding $100,000, according to a report from Google's Mandiant incident responders.

In one instance, a group called UNC6993 stole LLM API keys, generated additional keys, and enabled services within the victim's cloud projects, causing $100,000 in charges. The attackers also exploited premium foundation models, launched high-volume inference streams, and used a "burn and rotate strategy" to avoid rate limits. Another reported case involved Jet Night, a token routing service that offered an unlimited token plan for approximately $60 per month, benefiting from stolen keys.

Experts predict an increase in LLMJacking due to the growing number of criminals joining this ecosystem. To mitigate the risk, organizations should focus on identity and access management, supply chain security, and use centralized secrets management platforms to rotate keys and secrets, while applying least-access privileges to users and service accounts.