# R-15·cases 4·checked Nov. 15, 2026
Exposed AI infrastructure and stolen AI keys
AI services, clusters or API keys are reachable from the internet or leaked, and someone else uses them.
What it is
AI workloads come with new infrastructure: inference servers, training clusters, agent consoles and API keys with large spending limits. Some of it ships without authentication by design and assumes a protected network.
Attackers have used exposed AI clusters for crypto-mining and credential theft, and stolen AI service keys to resell access or run up bills. OWASP's 2026 entry on unbounded consumption lists inference infrastructure hardening as a mitigation.
Documented cases
Incidents happened in the wild. Research demos were shown by researchers, often disclosed to the vendor first.
Incidentdisclosed July 16, 2026·AML.CS0068 Malicious dataset used to break into Hugging Face clusters
Hugging Face says a malicious dataset used two code-execution paths in its dataset processing, a remote-code loader and a template injection in a dataset configuration, to run code on a worker. The intruder then harvested credentials and moved into several internal clusters over a weekend.
Hugging Face reports access to some internal datasets and service credentials, and no tampering with public models, datasets or Spaces. It closed both paths and rotated credentials. Its post does not name the attacker. MITRE's case study attributes the activity to autonomous agents from OpenAI cyber evaluations.
Sources: Hugging Face; MITRE ATLAS AML.CS0068
Incidentdisclosed Feb. 27, 2025·AML.CS0057 Storm-2139 resold access to hijacked AI service accounts
Members of a group Microsoft tracks as Storm-2139 scraped exposed customer credentials from public sources and used them to get into generative AI service accounts. They changed what the services would do, deliberately worked around Microsoft's safeguards, and resold the access.
Microsoft sued in December 2024, seized a website central to the operation and later named four developers in an amended complaint.
Sources: Microsoft; MITRE ATLAS AML.CS0057
Incidentdisclosed May 6, 2024·AML.CS0030 LLMjacking: stolen cloud keys used to run up AI bills
Attackers took cloud credentials from a server running a vulnerable version of Laravel (CVE-2021-3129) and used them to reach cloud-hosted language models. Their script checked stolen keys against ten AI services, including AWS Bedrock, Azure, OpenAI and Google Vertex AI.
Sysdig estimated a worst case of more than $46,000 a day in model costs for the victim. That figure assumes maximum quota use in several regions. Its advice: patch, keep secrets out of plain text, scope credentials tightly and log model invocations.
Sources: Sysdig Threat Research Team; MITRE ATLAS AML.CS0030
Incidentdisclosed March 26, 2024·AML.CS0023 ShadowRay: exposed Ray clusters taken over
Ray, an open-source framework for scaling AI workloads, has a Jobs API with no authorization. Oligo found internet-exposed clusters that attackers had been using since at least September 2023 to install crypto-miners, open reverse shells and collect credentials for services such as OpenAI, Hugging Face and Stripe.
The issue is tracked as CVE-2023-48022, which Anyscale disputes. Its position is that Ray is not meant to run outside a strictly controlled network.
Sources: Oligo Security; NIST National Vulnerability Database; MITRE ATLAS AML.CS0023
Controls to start with
- Keep AI frameworks that lack authentication, such as Ray's Jobs API, off untrusted networks.Vendor position in the CVE record
- Store AI API keys in a secrets manager, scope them tightly and log model invocations.Recommendations
- Harden inference infrastructure, and set spending caps so a stolen key has a ceiling.LLM06:2026, mitigations 2 and 10
Questions to ask vendors
Our suggestions, not taken from a framework.
- Which AI services and keys do we have, who owns each, and what is each key allowed to spend?
- Are any model servers, notebooks or agent consoles reachable from the internet?
Sources
- CVE-2023-48022 (disputed). NIST National Vulnerability Database, Nov. 28, 2023.
- LLMjacking: Stolen Cloud Credentials Used in New AI Attack. Sysdig Threat Research Team, May 6, 2024.
- OWASP Top 10 for LLM Applications 2026. OWASP GenAI Security Project, Aug. 3, 2026.
- MITRE ATLAS data, release 2026.10. MITRE, Oct. 28, 2026.
- NIST AI 600-1, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile. National Institute of Standards and Technology, July 2024.
- Security Incident Disclosure - July 2026. Hugging Face, July 16, 2026.
- Disrupting a global cybercrime network abusing generative AI. Microsoft, Feb. 27, 2025.
- ShadowRay: First Known Attack Campaign Targeting AI Workloads Actively Exploited In The Wild. Oligo Security, March 26, 2024.