Security researchers warn hackers are stealing paid AI access

In short: Security researchers say there is a growing wave of attacks where hackers steal access to companies’ paid AI tools and computing power.

What's going on

Researchers at Google’s Threat Intelligence Group say they have seen a major increase this year in “LLM-jacking”, which means hijacking access to large language models (AI systems that generate text, like a very advanced autocomplete).

In some cases, hackers steal usernames and passwords for public AI services, then sell that access on dark web marketplaces. Google’s researchers say these markets offer access to AI models from companies including Anthropic, Google, and OpenAI at discounts of up to 97%. Some advanced AI subscriptions can cost up to $200 per user each month.

Sellers sometimes offer “guaranteed access”, meaning they will replace the stolen login if it gets blocked. This suggests they expect AI companies to detect and shut down suspicious accounts.

In other cases, hackers break into a company’s cloud servers (computers rented over the internet) and run their own AI models on the victim’s equipment. Researchers compare this to the older trick of hijacking other people’s computers to mine cryptocurrency, which is like stealing electricity and hardware time to make digital coins.

What to watch

John Hultquist at Google Threat Intelligence Group warns that this gives attackers a cost advantage, because they get expensive AI “tokens” (the paid units used to run AI) far more cheaply than defenders. He also warns that as more companies host custom AI systems on their own servers, those systems may become bigger targets. He adds that unusual spikes in AI computing use can be easy to miss right now, because many companies are still figuring out what “normal” usage looks like.

Source: Financial Times