Mandiant investigated multiple 2026 intrusions in which attackers used enterprise access to large language models to generate unauthorized consumption charges. A November 2 report with Google Threat Intelligence Group describes individual incidents exceeding $100,000 in a day and some cumulative charges reaching $1 million before access was revoked.
The researchers distinguish initial intruders from operators of illicit routing services that aggregate and resell access. In this model, compromised credentials become inventory for a downstream service, while the affected organization receives the cloud bill.
Observed entry routes included exposed model endpoints and stolen cloud identities, service-account keys, repository tokens and active sessions. The report covers investigations across several regions and industries; its largest cost figures are incident observations, not an estimate of typical loss or the prevalence of this activity.
The report’s focus is consumption of backend resources. It does not require an attacker to persuade an employee-facing chatbot to reveal information: valid infrastructure access can be sufficient to incur charges.
NAOAT analysis
This changes the immediate economics of a credential theft. An intruder can monetize access through repeated service requests without first locating valuable documents or arranging an extortion payment. A technically successful API call can therefore represent a business failure even when the service itself is functioning normally.
The division of labor also complicates attribution within a company’s own usage records. The identity being billed, the intermediary routing a request and the person consuming the answer may be different parties. A large increase in traffic is evidence to investigate, not by itself proof of a particular criminal operator.
For organizations adopting metered AI services, the story connects security exposure to the speed at which consumption becomes a liability. The relevant incident boundary includes identity, resource access and billing visibility. Treating those as unrelated operational concerns can obscure how a stolen credential becomes a rapidly growing charge.