ASD warns that malicious actors are obtaining unauthorised access to organisations' AI services through compromised API keys, stolen tokens, phishing, vulnerable agent dashboards and third-party arrangements; such access can enable harmful content creation, model capability extraction, credit exhaustion and wider enterprise access. The guidance recommends inventory and least-privilege for AI accounts, phishing-resistant MFA, secrets management, separation of restricted model access, activity monitoring and rapid revocation and investigation of suspected compromises. The advisory cites recent incidents including Okta-reported stolen keys and a US$600,000 public-model credit consumption tied to an exposed agent dashboard.