--- url: "https://xcademia.com/news/someone-else-is-using-your-ai-fortinet-warns-of-aws-llmjacking-attacks" title: "Someone Else Is Using Your AI: Fortinet Warns of AWS LLMjacking Attacks" description: "Fortinet warns that stolen AWS credentials can be used to hijack AI models, creating unexpected costs and turning legitimate cloud access into LLMjacking." publishedAt: "2026-09-04T12:05:45.711+00:00" updatedAt: "2026-09-04T12:31:31.614622+00:00" type: news category: cybersecurity source_name: "FortiGuard Labs, Fortinet" source_url: "https://www.fortinet.com/blog/threat-research/someone-else-is-using-your-ai" tags: - "#LLMjacking" - "#CloudSecurity" - "#AWS" - "#AmazonBedrock" - "#AI Security" - "#CloudCredentials" - "#Cybersecurity" - "#ThreatResearch" --- # Someone Else Is Using Your AI: Fortinet Warns of AWS LLMjacking Attacks > Attackers are increasingly abusing stolen AWS credentials to hijack access to AI models, creating unexpected cloud costs and turning legitimate AI infrastructure into a source of illicit revenue. Source: **FortiGuard Labs, Fortinet** · 4 September 2026 **G**enerative AI is creating a new target for cybercriminals: access to someone else's AI infrastructure. FortiGuard Labs has detailed an attack involving a compromised AWS account where a stolen, long-lived IAM access key with administrator privileges was used to create a new identity, subscribe to foundation models through AWS Marketplace and invoke those models at the victim's expense. Fortinet classifies the activity as **LLMjacking**, a form of cloud credential abuse focused on stealing access to hosted AI models rather than model weights or training data. The incident highlights an important change in cloud security. A stolen credential does not necessarily have to be used to steal files or deploy cryptocurrency miners. Attackers can use legitimate cloud AI services and make the victim pay for the computing resources. ## What Is LLMjacking? LLMjacking is the unauthorised use of another organisation's access to hosted large language models. Instead of stealing an AI model itself, attackers obtain valid cloud credentials and use them to access AI inference services. They may consume the models themselves or attempt to resell the stolen access. Fortinet says the technique is attractive because it can require little additional tooling once a working cloud identity has been obtained. Potential sources of credentials include leaked access keys, exposed CI/CD secrets and stolen local credentials. The abuse can also be difficult to distinguish from legitimate activity. An API request made through a compromised but authorised IAM identity can look like a normal cloud API call at the service level. ![info-1](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1788523404971-info1--56-.webp) ## The Attack Chain Observed by Fortinet According to FortiGuard Labs, the observed AWS compromise began with a leaked long-lived IAM access key carrying `AdministratorAccess` permissions. The attacker then: 1. Created a new IAM user. 2. Subscribed to one or more foundation models through AWS Marketplace. 3. Invoked the subscribed models, generating inference charges against the compromised account. 4. Potentially generated Bedrock service-specific credentials for the new identity. The Marketplace activity involved `CreateAgreementRequest` and `AcceptAgreementRequest` requests to the AWS Marketplace agreement endpoint. This sequence matters because it demonstrates that the attack is not necessarily dependent on a vulnerability in the AI service. The attacker can abuse legitimate permissions after obtaining a sufficiently privileged cloud identity. ## Why AI Access Has Become Valuable Fortinet identifies several characteristics that make LLMjacking attractive to attackers. First, the infrastructure is already available. Once attackers obtain a usable cloud identity, they may not need to build a separate AI platform. Second, abuse can begin quickly after credential exposure. Fortinet notes that attackers can move from exposed credentials to abuse in minutes rather than days. Third, AI inference can create substantial financial exposure when high-capability models are consumed at scale. Fortinet references previous LLMjacking research reporting daily victim exposure ranging from tens of thousands of dollars to more than $100,000 in some scenarios. These figures come from the external research cited by Fortinet, rather than from the AWS incident described in this report. Finally, stolen AI access can potentially become a source of revenue. Fortinet says some campaigns have attempted to resell hijacked model access through subscription-style services. ![info-2](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1788523426833-info2--57-.webp) ## The Commercialisation of Stolen AI Access Fortinet also points to a broader underground market around stolen AI access. The company cites research describing thousands of attack sessions and marketplaces offering access to numerous LLM providers through messaging platforms. This indicates that LLMjacking is not simply about an attacker experimenting with a stolen account. It can form part of a wider criminal supply chain where access is obtained, monetised and potentially resold. This development reflects a broader industry shift toward treating cloud AI access as a valuable security asset. For enterprises, that means AI usage needs to be considered alongside other high-value cloud resources when assessing identity and access risks. ## How Organisations Can Reduce LLMjacking Risk FortiGuard Labs recommends several defensive measures. **Enable AWS CloudTrail across accounts.** CloudTrail can help security teams reconstruct identity creation, credential issuance, Marketplace activity and related actions. **Enable Bedrock invocation logging where feasible.** Fortinet notes that Bedrock invocation logging provides request-level information that CloudTrail does not capture and is disabled by default. **Reduce dependence on long-lived administrator credentials.** Fortinet recommends treating broad, long-lived IAM keys as high-risk and using short-lived, role-assumed credentials where workloads permit. **Correlate multiple signals.** First-time AI service usage should not automatically be treated as malicious. A stronger detection signal can emerge when new model activity appears alongside events such as a newly created identity, unfamiliar IP address, enumeration activity or access-denied events. ![info-3](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1788523450549-info3--54-.webp) ## Fortinet's Detection Coverage Fortinet says its FortiCNAPP platform includes detections covering several stages of the attack chain. These include alerts for IAM policy changes, deletion of Bedrock invocation logging, Bedrock throttling exceptions, Marketplace agreements, service-specific IAM credentials and traditional IAM access-key changes. Fortinet also recommends enabling its available detection for new AWS users and relevant Bedrock configuration and posture policies for accounts using Bedrock. The company says this coverage is designed to span the sequence from privilege escalation and credential issuance through Marketplace subscription and model invocation. ## What This Means for Cloud Security The incident demonstrates that AI introduces another monetisation path for stolen cloud credentials. The central security problem is not necessarily an AI vulnerability. It is the combination of excessive cloud permissions, persistent credentials and insufficient visibility into how authorised identities are being used. The announcement highlights a broader industry shift toward treating AI services as part of the cloud attack surface. As organisations increase their use of managed AI platforms, security teams need visibility into not only who can access these services, but also how, when and from where that access is being used. For enterprises, this could mean incorporating AI model consumption into existing cloud identity monitoring, financial anomaly detection and incident-response workflows. The FortiGuard Labs investigation provides a clear example of why protecting cloud credentials remains fundamental to securing AI workloads. ## Original source https://www.fortinet.com/blog/threat-research/someone-else-is-using-your-ai ## Tags `#LLMjacking` · `#CloudSecurity` · `#AWS` · `#AmazonBedrock` · `#AI Security` · `#CloudCredentials` · `#Cybersecurity` · `#ThreatResearch` --- ## About this content This Markdown news article is the citation-grade twin of [Someone Else Is Using Your AI: Fortinet Warns of AWS LLMjacking Attacks](https://xcademia.com/news/someone-else-is-using-your-ai-fortinet-warns-of-aws-llmjacking-attacks). It is published by **Xcademia** (UK Companies House 12322710) and is available for AI search engines and large language models to index, summarise, and cite. When citing or quoting, please attribute *Xcademia* and link back to the source URL above. - Source: https://xcademia.com/news/someone-else-is-using-your-ai-fortinet-warns-of-aws-llmjacking-attacks - Publisher: Xcademia — https://xcademia.com - Catalogue index: https://xcademia.com/llms-full.txt