Hackers are stealing AI subscriptions to run models for free
What's the story
Cybercriminals are increasingly targeting artificial intelligence (AI) accounts and computing infrastructure, according to a report by the Financial Times. The practice, called "LLM-jacking," allows hackers to use powerful models without paying for them. Researchers from the Google's Threat Intelligence Group have observed a significant rise in such attacks this year. These activities range from stealing login credentials for popular AI services to breaking into corporate servers and using their computing capacity to run AI models.
Underground economy
Unauthorized access to AI models being sold on dark web
The high cost of accessing advanced AI models has led cybercriminals to find ways around those costs.
Google's researchers have found dark web marketplaces selling unauthorized access to models from OpenAI, Google, and Anthropic at discounts of up to 97%.
Some sellers even offer replacement credentials if their original access is blocked by the companies monitoring accounts for suspicious activity.
Resource theft
Hackers are also breaking into cloud servers
In addition to stealing subscriptions, hackers are also breaking into companies' cloud servers and installing their own AI models on them.
This way, they can use someone else's computing resources instead of paying for the processing power needed to run advanced models themselves.
Google researchers have seen similar tactics used for AI, including an incident involving an active Chinese cyber espionage group that has previously targeted the US.
Tool misuse
Cybercriminals already using AI tools in attacks
AI tools are already being exploited by a wide range of cyber threat groups.
Anthropic, in its latest report on the misuse of its systems, said it had identified threat actors trying to use Claude for malicious purposes in over two dozen countries, including the US, UK, and Yemen.
The potential of AI to automate operations and analyze information faster could give attackers an edge over cybersecurity teams.
Detection difficulty
Businesses struggle to detect attacks
One of the biggest challenges for businesses is recognizing that an attack is happening at all.
As companies rapidly adopt AI, they are still figuring out how much computing capacity their new systems need.
Sudden increases in server usage may not immediately look suspicious, giving cybercriminals an opportunity to hide their activity among legitimate increases in AI workloads.