This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
Attackers are conducting 'LLMjacking' by using stolen cloud credentials to access and abuse hosted LLM services like AWS Bedrock and Anthropic Claude. By leveraging reverse proxies, they monetize this access by selling it to third parties, while the original cloud account owners incur massive, unauthorized usage costs. The attackers also use these services for role-playing, image analysis, and bypassing regional sanctions.
Attackers reportedly exploited stolen cloud credentials obtained through a vulnerable Laravel system (CVE-2021-3129) to allegedly abuse AI cloud services, including Anthropic’s Claude and AWS Bedrock, in a scheme referred to as “LLMjacking.” The attackers are said to have monetized access through reverse proxies, reportedly inflating victim costs to as much as $100,000 per day. Additionally, they allegedly bypassed sanctions, enabled LLM models, and evolved techniques to evade detection and logging.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Using AI systems to gain a personal advantage over others such as through cheating, fraud, scams, blackmail or targeted manipulation of beliefs or behavior. Examples include AI-facilitated plagiarism for research or education, impersonating a trusted or fake individual for illegitimate financial benefit, or creating humiliating or sexual imagery.
Also classified as
The hijacked LLMs were heavily used to generate adult-oriented, explicit roleplay content, bypassing standard safety filters.
The attackers hijacked LLM resources to gain personal advantage, specifically by committing financial fraud against cloud account owners and selling unauthorized access for profit.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The incident was caused by malicious human actors intentionally stealing credentials and abusing deployed LLM systems for financial gain.
The incident involves LLMjacking, where cybercriminals exploit vulnerable software to steal cloud credentials and abuse hosted LLM services. While causing severe financial losses to individual victim organizations and facilitating sanction circumvention, the national security threat remains minor and manageable within standard cybersecurity and cloud governance frameworks.
The report describes the AI systems acting as assistants that respond to user prompts, write scripts, and analyze images under direct human instruction and oversight.
Limited Risk: The systems abused are general-purpose chatbots and text/image generation models, which fall under the category of chatbots and generative AI requiring transparency under the EU AI Act.
The report states that 95% of the analyzed prompts were roleplay-related, which is a chatbot function, and also notes attackers using the LLM to write scripts.
The threat research reports provide highly detailed technical analysis, including API logs, specific cost calculations, and attacker prompts, leaving little ambiguity about the nature of the attacks.
The incident could be viewed purely as a traditional cloud credential theft incident, but the specific targeting and monetization of LLM resources makes it an AI safety/abuse incident.
Technology
Automatic Model Activation
Attackers easily enabled foundation models using simple API calls.
Inadequate API Log Controls
Attackers disabled model invocation logging via APIs to conceal actions.
Lack of Token Quota Guardrails
Absence of real-time rate limiting allowed massive token consumption.
Data Inputs
Stolen Cloud Credentials
Leaked AWS credentials allowed direct access to LLM APIs.
Unfiltered Malicious Prompts
Jailbreak prompts bypassed safety guidelines for adult roleplay.
Unrestricted Image Payloads
Base64 encoded images were processed without validation, aiding abuse.
Human Factors
Over-permissioned IAM Users
Users granted excessive permissions, allowing model activation.
Poor Secrets Management
Developers stored cloud credentials in vulnerable, plaintext locations.
Process and Methods
Inadequate Vulnerability Patching
Failure to patch Laravel CVE allowed initial credential theft.
Insufficient Runtime Monitoring
Lack of real-time alerts on unusual LLM API invocation patterns.
Weak Least-Privilege Enforcement
No Service Control Policies used to restrict unauthorized model access.
Management
Prioritizing Ease of Access
Cloud providers prioritized easy model activation over secure defaults.
Inadequate Risk Assessment
Management failed to assess financial risks from unauthorized LLM usage.
Regulatory Environment
Sanction Evasion Demands
Geopolitical sanctions created an illicit black market for LLM access.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
