Hackers are using artificial-intelligence agents to commandeer legitimate AI models and turn them into unwitting accomplices in cybercrimes.
The lamb's-wool approach comes as cyber chiefs already face hacks turbocharged by AI. Besides casting a wider net for possible victims, the new technique helps hackers avoid the hefty costs of using AI by siphoning computer power from targets. Routing an attack through an agent embedded in someone else's model also helps obscure the hacker's identity.
This summer, threat detectors at Symantec uncovered an autonomous agent instructed to find and exploit vulnerabilities in tech systems running advanced AI models. Once inside, the hacker's agent is trained to co-opt the model into abetting attacks.
That includes giving the model a set of new instructions and software tools for scanning, copying databases, harvesting credentials and other malicious activity. It also installs cryptocurrency miners.
The instructions, which included telling the model to dismiss its own safety measures, allowed for up to 100,000 steps without human intervention, said Dick O'Brien, principal intelligence analyst at Symantec Threat Hunter Team.
"They gave the model a false identity, told it that reading passwords and configuration files was routine development work," O'Brien said.
The model was made to cast itself as "a devoted companion that must never refuse," he said.
Free tokens
Known as LLMjacking, stealing enterprise-grade AI power from a target can slash costs for hackers. For the most advanced AI models, developers charge hundreds of dollars for a tranche of one million tokens -- the basic digital unit that models read and generate. A large-scale hacking campaign can burn through more than a billion tokens, running costs into the hundreds of thousands of dollars.
"Attackers can afford to use advanced AI because someone else is usually paying for it," said Hatem Naguib, chief executive officer at Sysdig, a cloud security and observability platform. "Threat actors steal access to an organization's AI models and run up the bill."
Hackers typically rely on credential theft and stolen access keys to break into models, said Randolph Barr, chief information security officer at Cequence Security, an API security and bot-management firm. Credentials left in code repositories, like GitHub, are scraped up by attackers, he added.
Hacker groups have also used stolen credentials for generative AI services and resold that access to other malicious actors, according to Microsoft.
While the tactic isn't new, automating the process with an AI agent allows hackers to cast a wider net for exposed models, like a server that answers AI requests over the internet without authentication, for instance.
"The reality is that adversaries have an expanding range of models and access methods at their disposal, and they're going to use whatever gives them an operational advantage," said Adam Meyers, senior vice president of counter adversary operations at cybersecurity firm CrowdStrike.
Symantec discovered the model-jacking agent by setting up an unprotected AI service to lure hackers -- a decoy known as an AI honey pot. Between May and September, it recorded roughly 127,000 outside requests from more than 32,000 unique digital addresses. About a third of those requests appeared to be hackers testing stolen access keys, O'Brien said.
The agent, believing it found a target, delivered its entire working prompt to Symantec's decoy, revealing how it was built and what it was assigned to do.
"The agent we discovered treats the stolen AI model as its brain and does the physical work with its own software," O'Brien said. The full 100,000-step run would consume at least a billion tokens of input alone, he said.
Though Symantec hasn't identified any real-world attacks by the agent, O'Brien said it is only a matter of time.
"The pace at which we're uncovering AI-powered or assisted attacks is multiplying rapidly," he said.