[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"news-post-\u002Fnews\u002Fgoogle-llmjacking-llm-mixers-stolen-ai-keys":3,"news-related-en-\u002Fnews\u002Fgoogle-llmjacking-llm-mixers-stolen-ai-keys":158,"hreflang-gtig-llmjacking-llm-mixers-2026-11":178},{"doc":4,"redirect":8},{"id":5,"title":6,"author":7,"author_avatar":8,"body":9,"category":138,"date":139,"description":140,"extension":141,"image":142,"meta":143,"navigation":144,"path":145,"seo":146,"seoDescription":147,"seoTitle":148,"stem":149,"tags":150,"translationKey":156,"updatedAt":8,"__hash__":157},"news_en\u002Fnews\u002Fgoogle-llmjacking-llm-mixers-stolen-ai-keys.md","Google says LLMjacking runs up $100,000 a day in stolen AI usage","Paul Lefizelier",null,{"type":10,"value":11,"toc":129},"minimark",[12,25,34,39,42,46,49,52,60,63,67,70,81,84,88,91,119,122,126],[13,14,15,16,24],"p",{},"On 2 November 2026, Google Threat Intelligence Group (GTIG) published ",[17,18,23],"a",{"href":19,"rel":20,"target":22},"https:\u002F\u002Fcloud.google.com\u002Fblog\u002Ftopics\u002Fthreat-intelligence\u002Fllmjacking-monetizing-compromised-cloud-models\u002F",[21],"nofollow","_blank","The Rise of LLMJacking",", a report on attackers who take over a company's paid access to large language models and run it at the company's expense. Google says Mandiant, its incident response unit, worked on several such cases in 2026, across cloud and model providers, in financial services, retail, technology and transportation, in North America, South America and Asia Pacific.",[13,26,27,28,33],{},"Google writes that it saw fraudulent charges above $100,000 in a single day in individual incidents, and cumulative charges at some organizations reaching $1 million before access was revoked. ",[17,29,32],{"href":30,"rel":31,"target":22},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fgoogle-llmjacking-attacks-rack-up-1-million-in-cloud-ai-charges\u002F",[21],"BleepingComputer"," covered the report on 3 November with the same figures.",[35,36,38],"h2",{"id":37},"faster-than-cryptojacking","Faster than cryptojacking",[13,40,41],{},"GTIG compares LLMJacking to cryptojacking, where stolen servers mine coins slowly in the background. The difference, according to the report, is speed: hijacked model access can produce large spikes in charges in a matter of hours. In several cases Mandiant investigated, the victim had not even turned on the AI services. The attackers used stolen access keys to enable services such as Bedrock or the Gemini API themselves, then ran up the bill in minutes or hours.",[35,43,45],{"id":44},"how-they-get-in","How they get in",[13,47,48],{},"Some attackers look for model endpoints left open on the internet. The report shows one testing exposed Ollama servers and trying to register its own models on them.",[13,50,51],{},"Google says the most common way in is stolen or exposed cloud credentials: IAM credentials, service account keys, GitHub personal access tokens and active session tokens. One cluster, which GTIG tracks as UNC6993, broke into a cloud instance through a misconfigured service account key. It also ran a fake portal that told users to paste a raw JSON payload containing a live access token, which let it skip passwords and multi-factor authentication.",[13,53,54,55,59],{},"Model API keys are a target on their own. GTIG describes a group that collected corporate LLM API keys from public GitHub repositories, then checked which ones still worked with requests capped at a single token (",[56,57,58],"code",{},"max_tokens=1","). Requests that small stayed under the volume alerts of the victims' security tools.",[13,61,62],{},"Once inside, the report says, attackers searched code repositories, logs, databases and secret managers for more credentials, created backdoor accounts and injected SSH keys. One follow-on group exploited a flaw in the LiteLLM gateway, CVE-2026-40217, to turn ordinary virtual keys into full admin credentials.",[35,64,66],{"id":65},"the-resale-market","The resale market",[13,68,69],{},"The report then follows the money. GTIG describes \"LLM Mixers\": services that pool stolen keys, meter usage, hide where requests come from and sell the access to subscribers. UNC6993 used open-source gateways such as new-api and gcli2api to spread requests across accounts, and Google believes it sells access through underground storefronts.",[13,71,72,73,76,77,80],{},"The clearest case is a token routing service called Jet Night. According to GTIG, an actor made more than 500,000 LLM API calls in under eight hours with stolen third-party keys to power it, and Jet Night passed nearly $1 million in token costs to the victim. Jet Night advertised an unlimited plan for about $60 a month with alleged access to frontier models. Google notes that a comparable consumer plan usually costs $100 to $250 a month, and says the service has posted several outages on its Telegram channel, likely as victims find and revoke the keys. GTIG lists ",[56,74,75],{},"jet-night.com"," and ",[56,78,79],{},"newapi.pro"," as indicators of compromise.",[13,82,83],{},"GTIG expects attackers to favour LLMJacking over cryptojacking as companies put more expensive models and agents into production.",[35,85,87],{"id":86},"what-google-tells-teams-to-do","What Google tells teams to do",[13,89,90],{},"The mitigation list in the report is long. The items that apply to almost anyone paying for AI usage:",[92,93,94,98,101,104,107,110,116],"ul",{},[95,96,97],"li",{},"Keep keys in a secrets manager and rotate them automatically.",[95,99,100],{},"Turn on secret scanning in GitHub or GitLab so a committed key is caught and removed.",[95,102,103],{},"Deny access to cloud LLM services to any account that does not need it.",[95,105,106],{},"Set per-model API quotas and spending caps.",[95,108,109],{},"Scope keys by model, environment and usage limit, so a key for a cheap model cannot call an expensive one.",[95,111,112,113,115],{},"Watch gateway logs for tiny requests such as ",[56,114,58],{},", which often come before large-scale abuse.",[95,117,118],{},"Patch model gateways such as LiteLLM, and enforce phishing-resistant multi-factor authentication.",[13,120,121],{},"Google also says enabling an AI service should itself be treated as a critical security event when nobody on the team asked for it.",[35,123,125],{"id":124},"why-it-matters-beyond-security-teams","Why it matters beyond security teams",[13,127,128],{},"An AI API key often sits in a side project, a no-code tool or a repository an agent wrote. The report describes what happens when such a key leaks: someone else's traffic runs on your account, and the invoice arrives in hours, not months. A spending cap on the provider's dashboard is the cheapest item on Google's list, and it is the one that limits the damage when everything else has failed.",{"title":130,"searchDepth":131,"depth":131,"links":132},"",2,[133,134,135,136,137],{"id":37,"depth":131,"text":38},{"id":44,"depth":131,"text":45},{"id":65,"depth":131,"text":66},{"id":86,"depth":131,"text":87},{"id":124,"depth":131,"text":125},"ai","2026-11-04T08:30:00","On 2 November 2026 Google Threat Intelligence Group described LLMjacking: attackers take over a company's access to AI models and resell it through 'LLM Mixers'. Some victims paid more than $100,000 in a day and up to $1 million in total.","md","\u002Fimages\u002Fnews\u002Fgoogle-llmjacking-llm-mixers.jpg",{},true,"\u002Fnews\u002Fgoogle-llmjacking-llm-mixers-stolen-ai-keys",{"title":6,"description":140},"Google Threat Intelligence Group says LLMjacking attackers resell stolen AI model access through 'LLM Mixers'. Fraudulent charges topped $100,000 in a day and reached $1 million at some firms.","LLMjacking: stolen AI keys cost victims $100,000 a day","news\u002Fgoogle-llmjacking-llm-mixers-stolen-ai-keys",[151,152,153,154,155],"security","llmjacking","api-keys","google","mandiant","gtig-llmjacking-llm-mixers-2026-11","ug4ksfp2ve0sWKkEebTlLc17D5Oj-eHpLLnH4vF_qT8",[159,166,172],{"title":160,"description":161,"path":162,"date":163,"image":164,"category":165},"Postman's desktop app installed its own plugins into Claude Code and Codex","A GitHub issue shows Postman desktop adding its plugins, a startup hook, a remote MCP server and a CLI to developers' coding agents through an automatic upgrade. Postman says it will make the opt-in clearer for existing users.","\u002Fnews\u002Fpostman-desktop-auto-installs-claude-code-codex-plugins","2026-11-04T08:25:00","\u002Fimages\u002Fnews\u002Fpostman-auto-installs-ai-coding-agent-plugins.jpg","tools",{"title":167,"description":168,"path":169,"date":170,"image":171,"category":138},"OpenAI says ChatGPT now handles a fifth of Google's search volume","At an OpenAI dinner in New York on 2 November 2026, ChatGPT consumer product lead Adam Fry said ChatGPT's search-like queries equal roughly one-fifth of Google's, and that weekly users rose from 1 billion to 1.2 billion in two months.","\u002Fnews\u002Fchatgpt-search-one-fifth-google-1-2-billion-weekly-users","2026-11-04T08:20:00","\u002Fimages\u002Fnews\u002Fchatgpt-search-one-fifth-google-volume.jpg",{"title":173,"description":174,"path":175,"date":176,"image":177,"category":138},"OpenAI says Astra and Codex are now drafting physical products","On 3 November 2026 OpenAI described internal work where models design enclosures, boards, and CAD. Two people built a Codex device with Astra in under a week. A newer internal model scored 0.875 on BenchCAD 2.0, against 0.594 for GPT-6 Astra.","\u002Fnews\u002Fopenai-astra-engineering-physical-products-cad","2026-11-03T16:10:00","\u002Fimages\u002Fnews\u002Fopenai-physical-engineering-astra-cad.jpg",{"en":179,"fr":258,"es":8},{"id":5,"title":6,"author":7,"author_avatar":8,"body":180,"category":138,"date":139,"description":140,"extension":141,"image":142,"meta":255,"navigation":144,"path":145,"seo":256,"seoDescription":147,"seoTitle":148,"stem":149,"tags":257,"translationKey":156,"updatedAt":8,"__hash__":157},{"type":10,"value":181,"toc":248},[182,187,192,194,196,198,200,202,206,208,210,212,218,220,222,224,242,244,246],[13,183,15,184,24],{},[17,185,23],{"href":19,"rel":186,"target":22},[21],[13,188,27,189,33],{},[17,190,32],{"href":30,"rel":191,"target":22},[21],[35,193,38],{"id":37},[13,195,41],{},[35,197,45],{"id":44},[13,199,48],{},[13,201,51],{},[13,203,54,204,59],{},[56,205,58],{},[13,207,62],{},[35,209,66],{"id":65},[13,211,69],{},[13,213,72,214,76,216,80],{},[56,215,75],{},[56,217,79],{},[13,219,83],{},[35,221,87],{"id":86},[13,223,90],{},[92,225,226,228,230,232,234,236,240],{},[95,227,97],{},[95,229,100],{},[95,231,103],{},[95,233,106],{},[95,235,109],{},[95,237,112,238,115],{},[56,239,58],{},[95,241,118],{},[13,243,121],{},[35,245,125],{"id":124},[13,247,128],{},{"title":130,"searchDepth":131,"depth":131,"links":249},[250,251,252,253,254],{"id":37,"depth":131,"text":38},{"id":44,"depth":131,"text":45},{"id":65,"depth":131,"text":66},{"id":86,"depth":131,"text":87},{"id":124,"depth":131,"text":125},{},{"title":6,"description":140},[151,152,153,154,155],{"id":259,"title":260,"author":7,"author_avatar":8,"body":261,"category":138,"date":139,"description":372,"extension":141,"image":142,"meta":373,"navigation":144,"path":374,"seo":375,"seoDescription":376,"seoTitle":377,"stem":378,"tags":379,"translationKey":156,"updatedAt":8,"__hash__":382},"news_fr\u002Ffr\u002Fnews\u002Fgoogle-llmjacking-llm-mixers-cles-ia-volees.md","Selon Google, le LLMjacking coûte jusqu'à 100 000 dollars par jour aux victimes",{"type":10,"value":262,"toc":365},[263,270,277,281,284,288,291,294,300,303,307,310,319,322,326,329,355,358,362],[13,264,265,266,269],{},"Le 2 novembre 2026, le Google Threat Intelligence Group (GTIG) a publié ",[17,267,23],{"href":19,"rel":268,"target":22},[21],", un rapport sur des attaquants qui détournent l'accès payant d'une entreprise aux grands modèles de langage et le font tourner à ses frais. Google indique que Mandiant, son équipe de réponse aux incidents, a traité plusieurs cas de ce type en 2026, chez plusieurs fournisseurs de cloud et de modèles, dans la finance, le commerce, la tech et le transport, en Amérique du Nord, en Amérique du Sud et en Asie-Pacifique.",[13,271,272,273,276],{},"Google écrit avoir observé, sur des incidents isolés, des frais frauduleux supérieurs à 100 000 dollars en une seule journée, et des montants cumulés atteignant 1 million de dollars dans certaines organisations avant que l'accès soit coupé. ",[17,274,32],{"href":30,"rel":275,"target":22},[21]," a repris le rapport le 3 novembre avec les mêmes chiffres.",[35,278,280],{"id":279},"plus-rapide-que-le-cryptojacking","Plus rapide que le cryptojacking",[13,282,283],{},"Le GTIG compare le LLMjacking au cryptojacking, où des serveurs volés minent de la cryptomonnaie lentement, en arrière-plan. La différence, selon le rapport, c'est la vitesse : un accès détourné à un modèle peut faire exploser la facture en quelques heures. Dans plusieurs cas étudiés par Mandiant, la victime n'avait même pas activé les services d'IA. Les attaquants ont utilisé des clés d'accès volées pour activer eux-mêmes des services comme Bedrock ou l'API Gemini, puis ont fait grimper la facture en quelques minutes ou quelques heures.",[35,285,287],{"id":286},"comment-ils-entrent","Comment ils entrent",[13,289,290],{},"Certains attaquants cherchent des points d'accès à des modèles laissés ouverts sur internet. Le rapport montre l'un d'eux en train de tester des serveurs Ollama exposés et d'essayer d'y enregistrer ses propres modèles.",[13,292,293],{},"Selon Google, la porte d'entrée la plus fréquente reste les identifiants cloud volés ou exposés : identifiants IAM, clés de comptes de service, jetons d'accès personnels GitHub et jetons de session actifs. Un groupe que le GTIG suit sous le nom UNC6993 est entré dans une instance cloud par une clé de compte de service mal configurée. Il a aussi monté un faux portail qui demandait aux utilisateurs de coller une charge JSON brute contenant un jeton d'accès valide, ce qui lui permettait de contourner mot de passe et authentification multifacteur.",[13,295,296,297,299],{},"Les clés d'API des modèles sont une cible à part entière. Le GTIG décrit un groupe qui récupérait des clés d'API d'entreprise dans des dépôts GitHub publics, puis vérifiait lesquelles fonctionnaient encore avec des requêtes limitées à un seul token (",[56,298,58],{},"). Des requêtes aussi petites passaient sous les alertes de volume des outils de sécurité des victimes.",[13,301,302],{},"Une fois à l'intérieur, d'après le rapport, les attaquants fouillaient dépôts de code, journaux, bases de données et gestionnaires de secrets à la recherche d'autres identifiants, créaient des comptes dérobés et injectaient des clés SSH. Un groupe arrivé ensuite a exploité une faille de la passerelle LiteLLM, CVE-2026-40217, pour transformer des clés virtuelles ordinaires en identifiants d'administration complets.",[35,304,306],{"id":305},"le-marché-de-la-revente","Le marché de la revente",[13,308,309],{},"Le rapport suit ensuite l'argent. Le GTIG décrit des « LLM Mixers » : des services qui mettent en commun des clés volées, mesurent l'usage, masquent l'origine des requêtes et vendent l'accès à des abonnés. UNC6993 utilisait des passerelles open source comme new-api et gcli2api pour répartir les requêtes entre plusieurs comptes, et Google pense qu'il revend cet accès sur des boutiques clandestines.",[13,311,312,313,315,316,318],{},"Le cas le plus net est un service de routage de tokens appelé Jet Night. Selon le GTIG, un acteur a passé plus de 500 000 appels d'API en moins de huit heures avec des clés tierces volées pour le faire tourner, et Jet Night a reporté près d'un million de dollars de coûts en tokens sur l'organisation victime. Jet Night proposait une offre illimitée à environ 60 dollars par mois, avec un accès supposé aux modèles de pointe. Google note qu'une offre grand public comparable coûte en général entre 100 et 250 dollars par mois, et que le service a annoncé plusieurs pannes sur sa chaîne Telegram, probablement quand les victimes découvrent et révoquent les clés. Le GTIG liste ",[56,314,75],{}," et ",[56,317,79],{}," comme indicateurs de compromission.",[13,320,321],{},"Le GTIG s'attend à ce que les attaquants préfèrent de plus en plus le LLMjacking au cryptojacking, à mesure que les entreprises mettent en production des modèles plus chers et des agents.",[35,323,325],{"id":324},"ce-que-google-conseille","Ce que Google conseille",[13,327,328],{},"La liste de mesures du rapport est longue. Celles qui concernent presque tous ceux qui paient pour de l'IA :",[92,330,331,334,337,340,343,346,352],{},[95,332,333],{},"Garder les clés dans un gestionnaire de secrets et les faire tourner automatiquement.",[95,335,336],{},"Activer le scan de secrets sur GitHub ou GitLab pour repérer et retirer une clé commitée.",[95,338,339],{},"Refuser l'accès aux services LLM du cloud à tout compte qui n'en a pas besoin.",[95,341,342],{},"Fixer des quotas d'API par modèle et des plafonds de dépense.",[95,344,345],{},"Restreindre chaque clé par modèle, environnement et limite d'usage, pour qu'une clé prévue pour un petit modèle ne puisse pas appeler un modèle cher.",[95,347,348,349,351],{},"Surveiller les journaux de passerelle pour repérer les toutes petites requêtes comme ",[56,350,58],{},", qui précèdent souvent un abus à grande échelle.",[95,353,354],{},"Mettre à jour les passerelles comme LiteLLM et imposer une authentification multifacteur résistante au phishing.",[13,356,357],{},"Google ajoute que l'activation d'un service d'IA que personne dans l'équipe n'a demandée doit être traitée comme un événement de sécurité critique.",[35,359,361],{"id":360},"pas-seulement-un-sujet-pour-les-équipes-sécurité","Pas seulement un sujet pour les équipes sécurité",[13,363,364],{},"Une clé d'API d'IA traîne souvent dans un projet perso, un outil no-code ou un dépôt écrit par un agent. Le rapport montre ce qui arrive quand une telle clé fuit : le trafic de quelqu'un d'autre tourne sur votre compte, et la facture arrive en quelques heures, pas en quelques mois. Un plafond de dépense dans le tableau de bord du fournisseur est la mesure la moins chère de la liste de Google, et c'est celle qui limite les dégâts quand tout le reste a échoué.",{"title":130,"searchDepth":131,"depth":131,"links":366},[367,368,369,370,371],{"id":279,"depth":131,"text":280},{"id":286,"depth":131,"text":287},{"id":305,"depth":131,"text":306},{"id":324,"depth":131,"text":325},{"id":360,"depth":131,"text":361},"Le 2 novembre 2026, le Google Threat Intelligence Group a décrit le LLMjacking : des attaquants prennent le contrôle de l'accès d'une entreprise aux modèles d'IA et le revendent via des « LLM Mixers ». Certaines victimes ont payé plus de 100 000 dollars en une journée, et jusqu'à 1 million au total.",{},"\u002Ffr\u002Fnews\u002Fgoogle-llmjacking-llm-mixers-cles-ia-volees",{"title":260,"description":372},"Le Google Threat Intelligence Group décrit des attaquants qui revendent des accès volés aux modèles d'IA via des « LLM Mixers ». Les frais frauduleux ont dépassé 100 000 $ en un jour et atteint 1 million chez certaines entreprises.","LLMjacking : des clés d'IA volées à 100 000 $ par jour","fr\u002Fnews\u002Fgoogle-llmjacking-llm-mixers-cles-ia-volees",[380,152,381,154,155],"securite","cles-api","5Q9GRe8ycrl3teZxVk56-o8nikAFaJmeNhkc5KRVZN4"]