Alleged LLMjacking Targets AI Cloud Services with Stolen Credentials

Attackers reportedly exploited stolen cloud credentials obtained through a vulnerable Laravel system (CVE-2021-3129) to allegedly abuse AI cloud services, including Anthropic’s Claude and AWS Bedrock, in a scheme referred to as “LLMjacking.” The attackers are said to have monetized access through reverse proxies, reportedly inflating victim costs to as much as $100,000 per day. Additionally, they allegedly bypassed sanctions, enabled LLM models, and evolved techniques to evade detection and logging.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.3 Fraud, scams, and targeted manipulation

The attackers hijacked LLM resources to gain personal advantage, specifically by committing financial fraud against cloud account owners and selling unauthorized access for profit.

Additional risk subdomains

• 1.2 Exposure to toxic content: The hijacked LLMs were heavily used to generate adult-oriented, explicit roleplay content, bypassing standard safety filters.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The incident was caused by malicious human actors intentionally stealing credentials and abusing deployed LLM systems for financial gain.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The systems abused are general-purpose chatbots and text/image generation models, which fall under the category of chatbots and generative AI requiring transparency under the EU AI Act.

AI system and alleged parties

• AI system: Claude, unspecified AI models (Anthropic)
• AI purpose: Chatbot; Code Generation
• Behaviour type: Assistant
• Alleged developer: OAI Reverse Proxy Tool Creators, LLMjacking Reverse Proxy Tool Creators
• Alleged deployer: LLMjacking Attackers Exploiting Laravel, Entities engaging in Russian sanctions evasion
• Alleged harmed parties: Laravel users, Laravel CVE-2021-3129 users, Cloud LLM users, Cloud LLM service providers

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Minor, indirect Minor
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Negligible, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Financial

Reported: The report explicitly describes massive financial losses to victim organizations due to unauthorized LLM usage charges.

Directly caused: Victims faced direct unauthorized API consumption costs of up to $46,000 per day for Claude 2.x and potentially over $100,000 per day for Claude Opus.

Indirectly caused: Organizations incurred indirect costs related to employing security personnel and deploying technology to detect and mitigate these attacks.

Inferred additional harm: It is highly likely that numerous other unquantified organizations suffered similar financial losses from undetected credential theft and LLM abuse.

People affected

• Occurrences reported: 1
• People reportedly harmed: 10
• People reportedly exposed: 10

Potential causes

Management

• Prioritizing Ease of Access: Cloud providers prioritized easy model activation over secure defaults.
• Inadequate Risk Assessment: Management failed to assess financial risks from unauthorized LLM usage.

Technology

• Automatic Model Activation: Attackers easily enabled foundation models using simple API calls.
• Inadequate API Log Controls: Attackers disabled model invocation logging via APIs to conceal actions.
• Lack of Token Quota Guardrails: Absence of real-time rate limiting allowed massive token consumption.

Data Inputs

• Stolen Cloud Credentials: Leaked AWS credentials allowed direct access to LLM APIs.
• Unfiltered Malicious Prompts: Jailbreak prompts bypassed safety guidelines for adult roleplay.
• Unrestricted Image Payloads: Base64 encoded images were processed without validation, aiding abuse.

Human Factors

• Over-permissioned IAM Users: Users granted excessive permissions, allowing model activation.
• Poor Secrets Management: Developers stored cloud credentials in vulnerable, plaintext locations.

Process and Methods

• Inadequate Vulnerability Patching: Failure to patch Laravel CVE allowed initial credential theft.
• Insufficient Runtime Monitoring: Lack of real-time alerts on unusual LLM API invocation patterns.
• Weak Least-Privilege Enforcement: No Service Control Policies used to restrict unauthorized model access.

Regulatory Environment

• Sanction Evasion Demands: Geopolitical sanctions created an illicit black market for LLM access.

Information quality

• Classification confidence: High
• Reason for confidence: The threat research reports provide highly detailed technical analysis, including API logs, specific cost calculations, and attacker prompts, leaving little ambiguity about the nature of the attacks.
• Ambiguities identified: The exact number of unique victim organizations is not fully quantified, though the scale of the attacks is clear.
• Alternative interpretations: The incident could be viewed purely as a traditional cloud credential theft incident, but the specific targeting and monetization of LLM resources makes it an AI safety/abuse incident.

The incident involves LLMjacking, where cybercriminals exploit vulnerable software to steal cloud credentials and abuse hosted LLM services. While causing severe financial losses to individual victim organizations and facilitating sanction circumvention, the national security threat remains minor and manageable within standard cybersecurity and cloud governance frameworks.

• Overall national security impact: Minor
• Scope: Multiple nations
• Primary target: No clear primary
• Other affected: Unknown
• Alleged perpetrator: Unknown

Threat characteristics

• Imminence: Long-term. Represents an ongoing cybercrime trend and strategic cloud security vulnerability rather than an immediate national security crisis.
• Autonomy: Human-controlled. The AI systems acted under direct human prompts and instruction, assisting human actors with tasks like script writing and roleplay.
• Novelty: Evolved capability. Represents a significant evolution in cybercriminal monetization strategies, shifting from traditional cryptojacking to LLMjacking.

Impact by dimension

• Physical security: Negligible. No physical infrastructure, kinetic targeting, or critical systems were affected or targeted in this cybercrime campaign.
• Information security: Minor. Attackers bypassed regional sanctions against Russia and used hijacked LLMs to write scripts for further tool development, representing minor intelligence and policy evasion concerns.
• Sovereignty: Minor. The bypass of regional sanctions against Russia represents a minor challenge to state-enforced economic statecraft and foreign policy measures.
• Economic security: Minor. Victim organizations faced significant unauthorized API bills of up to 100,000 dollars per day, but the threat remains manageable within standard cloud security and fraud prevention frameworks.
• Societal stability: Negligible. The generation of adult-oriented roleplay content and script writing does not pose a threat to broader societal stability or human rights.