Stolen AI API Keys Reportedly Ran Up $1 Million in Charges in One Day

Google and Mandiant have documented a pattern called LLMjacking, in which attackers steal AI API keys and use them to run expensive workloads. According to the report, one case generated roughly $1 million in charges within a single day. Keys are often exposed through leaks in code, repositories, logs, or shared prompts, and are harvested automatically. Victims typically learn of the abuse only after an unexpectedly large bill arrives. The recommended defenses include never committing keys, rotating and restricting them, setting spending caps and alerts, and monitoring usage for sudden spikes.