Protect your organisation's AI services

## Executive summary The advisory warns that malicious actors are obtaining unauthorised access to organisations' AI services via exposed API keys, stolen tokens, phishing, malware, vulnerable internet-facing applications and third-party suppliers; it cites recent incidents including theft of valid keys and large-scale consumption of model credits and provides concrete mitigation recommendations (inventory and least privilege, phishing-resistant MFA, secrets management, separation of sensitive access, monitoring, limits and rapid response).