LLMjacking: The AWS, Google Cloud and Azure settings that cap stolen AI keys (theainewsreport.com)

In a concerning development known as LLMjacking, attackers are exploiting stolen cloud and AI keys to run up massive bills on users' accounts, with reports indicating losses exceeding $1 million. Google’s Threat Intelligence Group (GTIG) has outlined the methods used by attackers, primarily involving stolen cloud tokens, IAM credentials, and vulnerabilities in platforms like LiteLLM and open Ollama servers. Victims often inadvertently enabled AI services before access was detected, a stark reminder that simply not using AI services does not guarantee safety. This phenomenon highlights the urgent need for enhanced security protocols across cloud platforms such as AWS, Google Cloud, and Azure to prevent unauthorized access. GTIG emphasizes the importance of enabling mandatory logging features, implementing stringent token-per-minute quotas, and understanding the limitations of budget alerts that may not react swiftly enough to prevent financial losses. The report suggests practical measures, including service control policies and active monitoring of model invocation logs, to safeguard against potential misuse and reinforces the significance of cybersecurity within the rapidly evolving landscape of AI and machine learning.