LLM token theft: Companies Face $100K+ in Daily Charges

LLM token theft happens when someone uses a company’s access to large language models without permission, turning stolen credentials into bills for computing and AI services. On Monday, November 2, 2026, reports suggested an ongoing security crisis involving unauthorized LLM use was circulating in tech news, with costs reportedly topping $100,000 per day and some victims facing $1 million in cumulative charges.

What is driving these six-figure AI bills?

Once criminals access a company’s LLM account, they can use its paid services without permission, leaving the organization to cover the charges. The costs can soar: Google’s Mandiant incident responders reportedly found daily bills above $100,000 at affected organizations, while some companies reportedly accumulated $1 million in charges before cutting off the intruders.

The figures come from reporting by Theregister, which covered Mandiant responders’ findings. These are reported losses, not a universal bill for every company.

How do token thieves exploit company access?

Stolen credentials can let outsiders consume AI services through a legitimate company account. That creates both a security incident and a billing problem: while investigating who used its access and stopping further activity, an organization may face $100,000+ in daily charges.

Google Threat Intelligence Group chief analyst John Hultquist said threat actors seek scale using agentic tools and tokens stolen from unwitting third parties. The report doesn’t say which models or account types were involved, so businesses shouldn’t assume that only one product tier is at risk. Any company giving staff or software access to paid AI services should know who can use each account and how it monitors that activity. So what can companies do to limit their exposure?

What steps can companies take to reduce the risk?

Start by treating AI credentials like sensitive access keys. Give access only to the people and services that need it, remove credentials that are no longer necessary, and set usage alerts and spending limits when providers offer them. These steps can’t guarantee an account won’t be compromised, but they can help teams spot unusual activity sooner and stop runaway costs from exceeding $100,000 per day.

If a company suspects unauthorized use, it should follow its incident-response process, revoke or replace exposed credentials, and review account activity and charges with its provider. Teams should also assign clear ownership of AI accounts, so alerts don’t go unclaimed. As businesses expand their AI deployments, keeping usage accountable across teams and services becomes a wider challenge.

What should businesses watch next?

Current reporting shows how large the losses can be, but it doesn’t name the affected organizations or break down the figures by model, provider, or attack method. Companies therefore lack a reliable benchmark for estimating their own exposure. They should use their actual provider rates and account activity, rather than treating the $100,000 daily figure as a forecast for every business.

As AI services become part of everyday company workflows, clear ownership, access controls, and billing oversight will matter alongside model choice. The next useful signal will be whether providers and incident responders share more about how organizations can detect and contain misuse.

FAQs

How much can illicit LLM use cost a company?

Mandiant incident responders cited daily costs above $100,000 at affected organizations. Some companies ran up $1 million in charges before access was revoked.

Does the $100,000 figure apply to every company?

No. The figure describes costs reported for affected organizations, not a standard charge for every incident. The source material doesn’t provide a breakdown by company.

What should a company do if it suspects unauthorized use?

It should follow its incident-response process, review account activity, and revoke or replace exposed credentials. It should also contact its AI service provider to investigate the usage and charges. Source: Theregister

Read Next

• Bhai Dooj 2026 Gift Ideas: 5 Long-Battery TWS Earbuds Your Sibling Will Actually Use
• Brother PR1060W Launched in India: A 1,000 SPM Embroidery Machine With a Built-In Camera
• AMD Adrenalin 26.10.2 Driver Released: Fixes for Valor Mortis, Death Stranding 2 and FSR SDK 2.4 on Vulkan