Google's Mandiant and Threat Intelligence Group describe attackers stealing LLM API keys and cloud credentials to run model usage on victims' accounts. Some organisations reached cumulative charges of $1 million before access was revoked. Routes include misconfigured service account keys and phishing for access tokens. The report recommends central secrets management with key rotation, least privilege for users and service accounts, and automated scanning for exposed keys in code.
