Top-tier Accounts Sold at 30% Discount, Hackers Stole Large Models for Attacks

Illegally seizing AI models and computing power is rapidly climbing to the top of the underground market's "most wanted" list. Hackers plan to use these expensive large models for ransomware, cyber warfare, and espionage.

John Hultquist, chief analyst at Google's Threat Intelligence Group, revealed that this year they have observed a significant increase in attacks called "LLM hijacking": some sell stolen login credentials of public AI tools, while others directly steal computing power and run their own models for free. This veteran with 20 years of security experience said that an "economy centered around AI access" is growing rapidly in the underground market.

Three-Fold Discount on Premium Accounts, Free Replacement if Banned

Gaining cheap access to expensive AI allows attackers to outspend defenders on paper—after all, defenders also need to use the same tools to protect themselves. Hultquist pointed out: they actually obtained these tokens at much lower prices.

Google found that on the dark web, there are already stalls selling access to models from Anthropic, Google, and OpenAI, with discounts as high as 97%. The premium subscription for ChatGPT and Claude can cost up to $200 per month per person, but here it is being sold at a huge discount. Since AI labs monitor abuse signs, some sellers even offer "guaranteed access": if the initial account gets banned, they will provide a new set of credentials for free.

Another method is even harsher: criminal groups or even state-backed organizations directly attack servers hosted by companies in the cloud and install their own models to run on them. This is similar to how hackers once infiltrated third-party machines to mine cryptocurrency. Hultquist believes that AI has been used by "all threat actors," and it will eventually become an essential part of security systems.

New Targets: Building Your Own Computing Power, Sneaking in Through Noise

Anthropic's latest abuse report mentioned that actors from over 20 countries, including the U.S., the UK, and Yemen, tried to misuse Claude for malicious purposes. Hultquist warned: anyone who thinks AI is just a passing trend and waits for it to fade will wake up one day to be overwhelmed—security incidents, alerts, and attacks will only increase, "you need to get your side in order now."

Related Recommendations

AIGCPanel v2.5.0 integrates with the cloud dual engine, with digital human and live voice tone libraries managed separately

AIGCPanel v2.5.0 brings cloud speech to desktop, enabling GPU-less users. Add a Volcano Engine Doubao or Alibaba Cloud Bailian DashScope API key under Other Models to enable high-quality cloud TTS. Keys are validated with a sample sentence before saving, simplifying setup.....

OpenAI, Anthropic, Hugging Face Call for International Coordination on AI, Trump Administration Opposes Global Governance

At UN, OpenAI, Anthropic, Hugging Face leaders urged stronger AI coordination and comparable standards for capability evaluation, safety testing, incident reporting. Trump administration opposed new global AI governance, saying risks don't justify limiting development or ceding regulation. Firms stressed common standards, rapid incident reporting.....

Qualcomm Teams Up with PrismML to Launch 1-bit Bonsai: Offline Image Recognition for AI Glasses, Memory Usage Reduced to 1/4

At the 2026 Snapdragon Summit, Qualcomm and PrismML ran a 2B-parameter 1-bit quantized Bonsai vision model locally on Snapdragon AR1 Gen 1 smart glasses, enabling offline image Q&A. Built on Bonsai 1.7B, 1-bit precision cuts memory to 1/4 of 4-bit models, allowing ~4x parameters in the same memory and reducing storage and inference needs.....

Kimi K3.1 May Conclude in October: Three Levels of Reasoning Power, Million-Long Context Agent, and Swarm Fully Included in Configuration

Multiple sources say Moonshot AI's flagship model Kimi K3.1 is taking shape internally, with release as early as October 2026, offering Low, High, and Max reasoning levels. Tipster @MaxForAI leaked internal JSON and API responses on X, revealing a "k3d1-agent" model ID with agent mode, scenarios, and config toggles, likely an early leak.....

AI Team Restructuring Frequently Tops Hot : Doubao's Response to the Rumor of Cutting Half of the Conversation Team Is Untrue

Doubao trended over rumors of downsizing its General Session team, with claims of layoffs, halving the dialogue team, and marginalization. PR head Liu Xing said reports reflect organizational restructuring with some functions split, denied layoffs, and called self-media interpretations inaccurate.....