Token thieves costing companies $100K+ per day in illicit LLM charges

Google’s Mandiant reports that criminals hijacking corporate LLM access can generate more than $100,000 in charges per day, with cumulative costs reaching $1 million at some victim organizations before access was revoked. Incidents included 500,000-plus API calls in under eight hours and one thief making about 200,000 requests in two minutes. Google says LLMJacking has increased steadily over two years and recommends stronger identity controls, secrets management, least-privilege access, and automated key scanning.

Analysis

The investable signal is less “AI security demand” than a potential tax on frictionless model usage. If stolen credentials let criminals capture below-cost inference, those prices are not a durable competitive benchmark: key revocations and service outages undermine the reliability needed for legitimate customers. That could support enterprise demand for identity controls, secrets management, and usage monitoring—but adoption may add approval steps and slow some agentic workloads, offsetting near-term consumption growth.

For Alphabet (GOOG), the exposure is two-sided: Mandiant’s findings can reinforce security credibility, while abuse of cloud/API access could create billing disputes, remediation costs, or customer trust issues. The article does not establish that Alphabet’s own services or financials were materially affected. For CrowdStrike (CRWD), being cited in threat research is not evidence of incremental product demand or revenue; treat it as a sector catalyst, not a company-specific estimate.

Over 1–3 months, watch for cloud-provider controls that make API access safer but more cumbersome, and for evidence that compromised usage is being credited or absorbed by providers. Over 6–18 months, the key question is whether secure identity and metering become prerequisites for scaled agentic deployment—or whether added controls slow usage enough to temper AI infrastructure growth. The contrarian risk is assuming every stolen-token dollar becomes legitimate security spend; budget may instead go to cloud-native controls or be deferred. No directional equity trade is justified by this report alone.

Key Decisions for Investors

• No event-driven position in GOOG or CRWD on this report alone. Reassess if either company discloses material abuse-related credits, remediation costs, customer losses, or a measurable security-product demand change.
• Add identity, secrets-management, and cloud-usage controls to cybersecurity diligence; require evidence of paid customer adoption or bookings before treating the incidents as a revenue catalyst for CRWD or peers.
• Track cloud-provider billing protections, key-rotation defaults, and incident-related credits over the next 1–3 months. A broad move toward stricter controls could reduce abuse but also add friction to legitimate API usage.
• Falsify the structural security-demand thesis if enterprise adoption indicators remain weak while providers resolve incidents mainly through standard billing controls, with no observable increase in paid security uptake.