Hackers Are Stealing AI Keys. The Cost Can Reach $600,000

The Australian Signals Directorate warns that attackers are obtaining unauthorised access to organisational AI services through exposed API keys, stolen tokens, compromised sessions and vulnerable internet‑facing applications; reported incidents include large-scale consumption of model credits and alleged access to restricted previews. The advisory details attack paths (phishing, info‑stealers, vendor compromise), highlights risks from AI agents interacting with enterprise systems, and gives mitigation guidance—inventory and ownership of AI accounts, least privilege, secrets management, phishing‑resistant MFA, monitoring, and incident response steps.