Stolen Model API Tokens Drive Six-Figure Daily Fraud

Key points

• Credential thieves are hijacking LLM API tokens to make unauthorized calls.
• Victim organizations face fraudulent billing exceeding $100,000 per day.
• The activity was reported on November 2, 2026, and involves no software vulnerability.
• IT teams should audit API keys, rotate exposed tokens, and set spend alerts.

On November 2, 2026, incident reports described a campaign in which attackers steal API access tokens and then use them to consume large language model services without permission. No CVE is associated with the activity; the intrusion relies on valid credentials rather than a software flaw. The immediate effect is unauthorized billing and monetary damage, with six-figure losses occurring every day.

Any organization that calls hosted model endpoints can be targeted, including public-sector teams and school systems that use these services for productivity or student-support tools. Because the stolen tokens are legitimate, the abuse can blend into normal traffic until billing or usage anomalies appear. Attackers do not need to compromise a server or exploit a vulnerability; they only need a working credential.

The financial exposure is significant because model usage can scale rapidly and charges accrue per request or per token. A single leaked key can generate thousands of dollars in hours, and the daily total across victims reportedly exceeds $100,000. The absence of a CVE means patching will not solve the problem. Instead, the incident highlights secrets management, key hygiene, and billing monitoring as core controls.

Common leakage paths include source-code repositories, logs, notebooks, and misconfigured clients that embed keys. Organizations should watch for sudden usage spikes, unfamiliar source addresses, new model deployments, and token-creation events. Provider dashboards, spend alerts, and per-key quotas are practical detection points. The key lesson is that API credentials deserve the same protection as passwords, with short lifetimes and strict scoping.

What to do now

1. Immediately inventory all LLM API keys and revoke any that are unused, shared, or exposed; rotate keys on a scheduled basis.
2. Set hard spend limits, budget alerts, and per-key rate quotas with your model provider to cap abuse.
3. Scan repositories, CI logs, notebooks, and client bundles for embedded secrets; remove and rotate any found.
4. Restrict each key to required services, models, and source networks; avoid broad production keys in development.
5. Enable detailed API audit logging and monitor for anomalous usage patterns, new keys, and unusual IPs.
6. Use short-lived tokens or workload identity where supported; avoid long-lived static keys.
7. Brief developers and staff on secure secret handling and establish a rapid revocation runbook.

Original source

The Register — Security