Leaked AWS keys expose Bedrock models to LLMjacking

Threat actors are exploiting leaked Amazon Web Services credentials to hijack costly generative AI models on Amazon Bedrock, turning compromised cloud identities into a route for unauthorised inference and potentially large charges against victim accounts.

FortiGuard Labs disclosed on September 3 that it had analysed an AWS account compromise involving a long-lived Identity and Access Management access key carrying AdministratorAccess permissions. The stolen credential was used to create a new IAM user, subscribe to foundation models through AWS Marketplace and invoke those models, generating inference costs for the victim.

The incident illustrates a technique known as LLMjacking, in which attackers abuse valid cloud credentials to consume hosted large language model services without paying for them. Rather than stealing model weights or training data, the objective is to make another organisation’s account fund expensive model usage, which can be consumed directly or resold to third parties.

FortiGuard said the attack chain began with a single administrator-level access key that did not expire automatically. After gaining access, the operator created a fresh identity and accepted marketplace agreements required for one or more foundation models. Calls to the subscribed models then produced billable inference activity on the compromised AWS account.

The security company said this type of intrusion can also include the creation of service-specific Bedrock credentials for the newly established identity, either as an alternative to ordinary IAM access keys or as an additional means of maintaining model access. Amazon Bedrock supports both IAM-based authentication and temporary credentials issued through AWS security services.

The risk is amplified because malicious model calls made with a valid compromised identity can resemble legitimate activity at the application programming interface level. A standard InvokeModel request from an authorised IAM principal does not, by itself, distinguish an attacker from a genuine user, making identity context, logging and behavioural signals important for detection.

FortiGuard said organisations should monitor for combinations of activity rather than treating first-time Bedrock use as automatically malicious. Warning signs can include the creation of a new IAM identity, access from an unfamiliar internet address, unusual enumeration behaviour, repeated access-denied events, marketplace agreement activity and unexpected model invocations.

The company recommended enabling AWS CloudTrail across accounts so administrators can reconstruct identity creation, credential issuance, marketplace subscription and related actions. It also advised enabling Amazon Bedrock invocation logging, which records request-level activity and can provide additional visibility into model use.

AWS advises customers to prefer temporary security credentials and IAM roles over long-lived access keys wherever possible. Its IAM guidance states that long-term keys remain valid until they are manually revoked, while temporary credentials expire after a limited period, reducing the exposure window if credentials are leaked.

AWS also recommends applying least-privilege permissions, reviewing and removing unused identities and credentials, requiring multi-factor authentication where applicable and using policy conditions and access-analysis tools to restrict how credentials can be used. Bedrock supports temporary credentials, allowing organisations to avoid permanent keys for many workloads.

The financial implications of LLMjacking can be substantial because premium foundation-model inference is charged according to usage. Earlier research into the technique estimated that abuse of high-end hosted models could expose victims to tens of thousands of dollars in costs in a single day, depending on the model, request volume and pricing structure.

Security researchers first documented LLMjacking as a distinct form of cloud abuse in 2024. Subsequent investigations have shown attackers testing stolen credentials for access to multiple AI providers and, in some cases, reselling compromised model access through subscription services.

FortiGuard classified the analysed Bedrock incident as high severity because it combined credential theft with unauthorised use of paid AI services and the possibility of model access being resold. The affected platform was AWS, with Amazon Bedrock identified as the service used for inference.