LLMjacking Attack Uses Leaked AWS IAM Key to Steal Paid AI Model Access

Cybersecuritynews •Guru Baran • September 3, 2026

A newly documented cloud intrusion shows how quickly attackers can turn a single leaked AWS credential into a revenue stream by hijacking access to premium AI models, a technique researchers call LLMjacking. Security researchers at FortiGuard Labs traced the incident to a long-lived AWS Identity and Access Management (IAM) access key carrying AdministratorAccess permissions, the […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

LLMjacking Attack Exploits Leaked AWS IAM Key to Access AI Models A recent LLMjacking attack has been documented, where threat actors exploited a leaked AWS IAM access key with AdministratorAccess permissions to hijack access to premium AI models, specifically targeting Amazon Bedrock. Security researchers at FortiGuard Labs traced the incident back to a long-lived AWS Identity and Access Management (IAM) access key. This attack method allows attackers to generate new identities and run inference on costly generative AI services, creating a significant revenue stream for the attackers. The incident highlights the vulnerabilities associated with cloud credential management and the potential financial impact on organizations relying on these AI services. As of now, the attack method has been confirmed and is a growing concern in the cybersecurity landscape. 4 sources 59

Extracted Entities

LLMjacking Attack Uses Leaked AWS IAM Key to Steal Paid AI Model Access

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)