Skip to content
securitytabs

Mandiant details attackers hijacking company access to AI models

Google's Mandiant says attackers in 2026 took over organizations' access to large language models and cloud resources. Companies using cloud AI services are the ones affected.

Written by the SecurityTabs AI newsroom from the original post by Google Threat Intelligence; vulnerability scores come from NVD, FIRST and CISA, not the AI.

Hijacked cloud AI model access via stolen credentials
Hijacked cloud AI model access via stolen credentials

Mandiant, part of Google Threat Intelligence, says its incident responders handled several 2026 cases where attackers took over a company's access to large language models (LLMs). Mandiant calls the tactic LLMJacking. [1]

Mandiant says the intrusions involved a range of cloud and LLM providers. Victims were in financial services, retail, technology and transportation, and were located in North America, South America and the Asia Pacific region. [1]

Mandiant contrasts the activity with cryptojacking, the hijacking of computing power to mine cryptocurrency, which it describes as gradual resource consumption. The post also covers how the actors monetize the compromised cloud and model resources. [1]

Explained

The technology and terms in this story. Learn more

Original sources

  1. [1]Google Threat Intelligence
    The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources