Someone Else Is Using Your AI

FortiCNAPP documents and analyzes LLMjacking — a cloud credential theft technique where attackers use stolen AWS IAM keys to subscribe to and invoke paid foundation models on AWS Marketplace and Bedrock, producing large unauthorized inference charges (reported exposures of tens to hundreds of thousands USD per day) and enabling resale of access; the report describes an observed compromise using an AdministratorAccess key, outlines detections and defensive recommendations, and lists Fortinet product coverage for detection and response.