LLMjacking Attack Abuses Leaked AWS Credentials to Hijack Amazon Bedrock AI Models

Gbhackers •Divya • September 4, 2026

Threat actors are increasingly converting stolen cloud credentials into access to costly generative AI services, a technique known as LLMjacking. FortiGuard Labs reported an incident involving Amazon Bedrock in which a leaked, long-lived AWS IAM access key with AdministratorAccess permissions was used to create a new identity, to foundation models, and run inference at […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

LLMjacking Attack Exploits Leaked AWS IAM Key to Access AI Models A recent LLMjacking attack has been documented, where threat actors exploited a leaked AWS IAM access key with AdministratorAccess permissions to hijack access to premium AI models, specifically targeting Amazon Bedrock. Security researchers at FortiGuard Labs traced the incident back to a long-lived AWS Identity and Access Management (IAM) access key. This attack method allows attackers to generate new identities and run inference on costly generative AI services, creating a significant revenue stream for the attackers. The incident highlights the vulnerabilities associated with cloud credential management and the potential financial impact on organizations relying on these AI services. As of now, the attack method has been confirmed and is a growing concern in the cybersecurity landscape. 4 sources 59

LLMjacking Attack Abuses Leaked AWS Credentials to Hijack Amazon Bedrock AI Models

The full story

Extracted Entities

Companies (2)

Platforms (1)