gcdRadar
archive/Breaches & attacks/AIR-2024-0028
closedclosed 20 May 2024Breaches & attacks4 Confirmed real-world lossAI

LLMjacking Attackers Abuse Cloud AI Services Using Stolen Credentials

Claude, AWS Bedrock

Attackers leveraged stolen cloud credentials to abuse AI platforms like Anthropic Claude and AWS Bedrock through reverse proxies. The scheme inflated victim costs significantly while evading logging and detection mechanisms.

CVSS
9.8
EPSS
1.00 · top 0.1% · 2026-11-13
EPSS scores by FIRST
first report
6 May 2024
last update
6 May 2024
CVE ids
CVE-2021-3129other records

Timeline · 1

  1. 6 May 2024Alleged LLMjacking Targets AI Cloud Services with Stolen Credentials

Sources · 1

Research and catalogues

  1. 2024-05-06
    Alleged LLMjacking Targets AI Cloud Services with Stolen Credentials
    AI Incident Database · incidentdatabase.ai/cite/898

Titles and links belong to their publishers. The summary above is written by gcdRadar in its own words; data is CC BY-SA 4.0.

Classification

lane
Breaches & attacks
AI role
AI-enabled attack
categories
Other
severity
4 · Confirmed real-world loss
targets
Anthropic, Amazon, Enterprise deployment
owasp llm top 10
no entry for these categories
mitre atlas
no technique for these categories
tags
llmjackingcredential-theftaws-bedrockclaude
dates
happened 6 May 2024 · first reported 6 May 2024
origin
AI Incident Database
Derived from the AI Incident Database (CC BY-SA 4.0).
record
confidence 0.85 · created 2026-10-18 06:33Z · updated 2026-10-18 06:59Z

Lane, AI role, categories and severity come from the classifier; the OWASP and ATLAS rows are derived from the categories. How these are assigned

Copy a brief

This record as a short Markdown brief, for a ticket, a chat or a coding agent.

the brief as text
# LLMjacking Attackers Abuse Cloud AI Services Using Stolen Credentials

https://gcdradar.vercel.app/incidents/llmjacking-attackers-abuse-cloud-ai-services-using-stolen-cr · AIR-2024-0028 · closed 2024-05-20

- Lane: Breaches & attacks
- Severity: 4 (Confirmed real-world loss)
- Fix status: No fix needed
- First reported: 2024-05-06
- AI role: AI-enabled attack
- Products: Claude, AWS Bedrock
- CVE ids: CVE-2021-3129
- CVSS: 9.8

## Summary

Attackers leveraged stolen cloud credentials to abuse AI platforms like Anthropic Claude and AWS Bedrock through reverse proxies. The scheme inflated victim costs significantly while evading logging and detection mechanisms.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2024-05-06: Alleged LLMjacking Targets AI Cloud Services with Stolen Credentials (https://incidentdatabase.ai/cite/898)

## Sources

- 2024-05-06 AI Incident Database: Alleged LLMjacking Targets AI Cloud Services with Stolen Credentials https://incidentdatabase.ai/cite/898

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.

Related

  1. closed
    AWS Bedrock Threat Actors Hijack Cloud-Hosted LLMs via Stolen Credentials

    Patch now · Exploited · since 6 May 2024

    AI
  2. closed
    Claude Anthropic Claude Jailbroken and Used in Mexican Government Data Theft

    Breaches & attacks · Real loss · since 1 Dec 2025

    AI
  3. closed
    Music Producer Arrested for AI Streaming Fraud Scheme

    Breaches & attacks · Real loss · since 4 Sep 2024

    AI
  4. closed
    ChatGPT API AkiraBot Operators Leverage OpenAI API to Automate Widespread Contact Form Spam

    Breaches & attacks · Exploited · since 1 Sep 2024

    AI
  5. closed
    OpenAI Assistants API SesameOp Backdoor Abuses OpenAI Assistants API for C2

    Breaches & attacks · Exploited · since Jul 2025 (approx.)

    AI
  6. closed
    Claude Anthropic Identifies AI Misuse in Extortion and Ransomware Campaigns

    Breaches & attacks · Exploited · since 27 Aug 2025

    AI