Cyberattacks related to artificial intelligence are multiplying. Hackers are stealing access keys to AI services to resell or exploit them, and are using AI agents to accelerate their intrusions.
In the space of a month, at least a dozen platforms intended for AI developers have been targeted. The most recent incidents involve CommandCode, Northflank, Trigger.dev, Chainstack and WorkOS. Other companies cited include Andromeda, Brev (NVIDIA), Fireworks AI, Lightning AI, OpenCode, Railway, Warp and Zeabur, whose attackers were mainly looking for secrets stored on behalf of their clients.
In all these cases, the hackers appear to be seeking AI access tokens, i.e., credentials for using language models, which they can monetize. The attacks do not appear to be linked to each other, even though they are part of the same trend. The entry point varies: compromised credentials, third-party provider dependencies, or exploitation of vulnerabilities.
Coveted credentials
The Cloud Security Alliance warns about the very nature of these platforms. ‘Intruders reach AI provider credentials via the intermediate layer of hosting platforms, evaluation services and developer consoles,’ the organization writes. Since this layer holds credentials on behalf of many clients, ‘a single intrusion can simultaneously expose the keys of many inference accounts.’
According to Wiz’s analysis, this search for credentials is explained by the rise of LLM-jacking, i.e., the hijacking of access to language models, and by the development of intermediary infrastructures providing access to these models. These mechanisms make stolen tokens easy to monetize, which, according to the cybersecurity company, should attract more malicious actors to credential theft. Wiz also notes that this demand is fueled by distillation, which involves training a less expensive model from the responses of a more advanced model, a practice the company associates with Chinese AI labs, although this is not established.
Wiz states it has observed hackers exploiting compromised corporate credentials in these attacks. Two cases shared ‘an identical initial unauthorized activity, occurring within 30 minutes of the credential access reported in the vendor breach.’ The company also found that several malicious actors were using the same compromised keys, which, it says, ‘suggests a robust market for this type of credential.’
Artex, an automation tool
This week, Chainstack, a blockchain infrastructure and Web3 services provider, and WorkOS, an enterprise application programming interface platform, announced cyberattacks relying on Artex, an open-source AI-assisted penetration testing framework. Several companies have also linked attacks attributed to the Chinese APT Storm-0940 to Artex, including a campaign targeting ConnectWise customers.
Chainstack was hit on October 26. The attackers accessed a development environment and part of the company’s production environment via a third-party component. According to the company, the database accessed contained information on customer accounts, including organization names, account holder names, email addresses and password hashes. Node credentials may also have been exposed, and Chainstack has asked its customers to renew them.
On October 30, WorkOS indicates that hackers compromised an internal application used by its sales team. They accessed business contact details and summaries of communications with customers, as well as information on the use of WorkOS products.
