Day-2 debrief | One stolen identity, 200,000 AI requests in two minutes. Can your SOC respond in time?

In an LLMjacking campaign documented by CrowdStrike in 2026, an attacker compromised one cloud identity, escalated access, and unlocked foundation model services across multiple models and regions. The result was nearly 200,000 model requests in two minutes, and the only thing that stopped it was a service quota.

This is the fourth news signal analysis from Episode 1 of the Day-2 Debrief, Gruve’s monthly series analyzing the top industry news CIOs and CISOs need to know. Matt Locknane and Rajeev Khanolkar explain why AI usage is now a security and cost event, what your SOC should detect, and what it should be allowed to contain automatically.

In this clip:

• Why LLMjacking traffic looks like normal AI adoption
• Detecting the shape of AI traffic: unused regions, unused models, dormant identities, machine-speed calls
• Making model access an explicit, scoped entitlement with default deny for new services and regions
• Why a two-minute attack can’t wait for a human to be paged
• Four automated containment actions: kill the credential, quarantine the workload, cut the egress path, freeze scope expansion
• One correlation key across identity, usage and cost telemetry
• Why governance has to pre-authorize automated actions, and why change control can’t keep up
• The decision every organization has to make about trusting automation