Hackers Profit from Stolen Access Keys to Corporate AI Agents

Hackers have found a new way to profit from corporate AI assistants. According to dev.ua, attackers compromise corporate accounts, gain access to expensive AI models, and resell it to other users at low prices. Companies that are unaware of the 'uninvited guests' then receive bills for hundreds of thousands of dollars.

How the Scheme Works

Attackers steal access keys to corporate AI assistants, allowing them to use expensive models without paying. These keys are then resold to other users who gain access to powerful AI tools at a significantly lower cost. For companies, this results in unexpected expenses: AI usage bills can reach hundreds of thousands of dollars, even if the companies themselves do not notice any unauthorized activity.

Why This Matters for Business

For small businesses, this means that even small companies using AI tools can become victims. Stolen access keys can lead to significant financial losses, as well as data breaches if attackers gain access to corporate information. Meanwhile, the AI agent market is actively evolving: for instance, Chinese lab DeepSeek recently unveiled a prototype of an autonomous AI agent for coding, aiming to compete with Anthropic's popular Claude Code tool, as reported by dev.ua.

What Companies Should Do

To protect against such threats, it is advisable to regularly review AI service usage logs, implement multi-factor authentication, and restrict access to keys. It is also important to stay updated on security patches from AI solution providers.

Conclusion

The theft of access keys to corporate AI agents is becoming a serious threat to businesses. Companies must remain vigilant and take measures to secure their accounts to avoid financial losses and data leaks.

💡 Need help with an article topic? Learn about our service — AI Process Audit.