Sysdig LLMjacking: Stolen Cloud Credentials Hijack LLMs
Date: 2024-05
Affected: AWS Bedrock, Anthropic Claude (via stolen creds)
Attack vector: tool-abuse
Category: threat-report
Severity: High

Sysdig TRT identified LLMjacking in May 2024: attackers using stolen cloud credentials (initially AWS) to hijack Anthropic Claude 2.x access, costing victims ~$46K/day; later $100K+/day with newer models. Evolved into industrial marketplace.


Mitigations:

Architectural layers (MAESTRO):