Google analyst warns of surging AI account and cloud compute hijacking

John Hultquist, chief analyst at Google Threat Intelligence Group, said in a recent interview that cyberattacks targeting AI accounts and computing resources have grown significantly this year, with a tactic known as “LLM-jacking” gaining traction in the cybercriminal underground.

According to Google researchers, dark web markets are selling access to AI models from Anthropic, Google and OpenAI at discounts as high as 97%. Some sellers even offer “guaranteed access” services that replace banned accounts for free, making the illegal operations more stable.

Hultquist also said criminal groups and state-backed hackers are breaching enterprise cloud servers to deploy their own AI models, forcing victims to pay for the computing power. He noted that this creates an economic imbalance, as attackers obtain compute at a much lower cost while defenders pay full price.

He cited Anthropic’s abuse report showing that threat actors in more than 20 countries, including the United States, the United Kingdom and Yemen, have attempted to misuse its Claude tool. “Every threat actor is using AI,” he said.

He warned that as more companies deploy custom AI models on their own servers, those internal systems will become new targets, and the period just after AI infrastructure is set up offers the best opportunity for intruders to slip in.