AI agents are stealing AI keys to pay for their own cyberattacks

What it's about

On November 13, 2026, Amazon Threat Intelligence, the threat analysis team at Amazon Web Services (AWS), published an unusual report. It covers AI agents, meaning AI programs that carry out multiple steps on their own, being used for cybercrime. What makes it stand out: Amazon was effectively able to look over the agents' shoulders and read their own records of ongoing campaigns.

At their core, the logs reveal two campaigns. In the first, agents hunted for access keys to AI models on a massive scale. In the second, they tried to get past identity verification at two crypto exchanges using forged IDs and real-time deepfakes, AI-generated videos that impersonate a real person. Tech site TechBooky describes the most striking finding as a potential loop: the stolen keys pay for the AI compute the agents use to find even more keys.

How Amazon got a view inside the attacks

Amazon runs MadPot, a globally distributed network of decoy systems known as honeypots. These are services designed to look vulnerable, existing only to lure attackers and record what they do, with no real customer data involved. Between October 3 and November 5, 2026, some of these sensors posed as common language model endpoints, meaning servers you send text to and get an AI response back from.

The attacking agents apparently took these decoys for real AI servers they could use, and sent their requests there. Because agent frameworks send their entire working context with every request, those requests contained system prompts, tool histories, the state of a shared knowledge graph and findings already reported. A single record often held the full history of a campaign up to that point.

Amazon attributes the activity with "medium confidence" to the open-source framework ARTEX. ARTEX is actually a penetration testing tool, used for authorized attack simulations that companies run to test their own security. Clues pointing to it turned up in the prompts and other technical traces.

The work was split across different roles: planner, worker, verifier and compression agents, all sharing a persistent knowledge graph as common memory. Each agent reads from it and writes its results back, so the next one picks up where the last left off. The records describe reconnaissance, vulnerability testing, credential theft, cloud privilege escalation and crypto fraud across hundreds of targets.

Campaign 1: AI keys on an industrial scale

The attackers gave the agents standing orders: work through countries in a fixed order, prioritize companies' production systems over personal projects, and grade every key. The levels were L1 (lead), L2 (confirmed working API call) and L3 (measurable impact, such as readable data or spendable credit). Keys that had been publicly exposed for more than 30 days counted as "low-value inventory", presumably because they're usually already revoked or drained.

Apps that bundle many provider keys, such as AI gateways, were especially prized. A single poorly secured admin panel there can expose access to many accounts at OpenAI, Anthropic and others all at once. The report names gateways and proxies like One API, New API, Veloera, Sub2API and LiteLLM, as well as AI app builders like Dify, FastGPT, Langflow, RAGFlow, Open WebUI, LobeChat and Ollama.

The agents worked from a fixed "playbook" that mapped each detected product to its known attack chain. It included:

• installations that were never fully set up and can simply be taken over
• admin endpoints with no authentication
• default admin passwords, such as LiteLLM's default master key
• known vulnerabilities like CVE-2025-3248 (Langflow) and CVE-2026-28797 (RAGFlow)
• an authentication bypass via the "isCliRequest" header on One API systems
• SSRF through URL-fetching features (tricking the server into querying internal cloud metadata)
• secrets in JavaScript, source maps, debug routes and .env configuration files

The search drew on internet scanners, certificate transparency logs, GitHub repositories and their event archives, npm and PyPI packages, container images, notebooks, model hosting sites, paste sites and Telegram channels. Keys that were found got validated, added to a managed pool and fed into the attackers' own model gateway. Premium frontier models took priority over general cloud privileges.

Campaign 2: Deepfakes versus ID checks

The second campaign targeted KYC ("know your customer") checks, the legally required identity verification where you upload, say, a selfie video and a photo of your ID. The agents analyzed one vendor's liveness protocol in detail. A liveness check is meant to confirm that a real, living person is in front of the camera, for example by having them turn their head in specified directions.

The best recorded attempt completed the entire movement sequence, with the face landing within 7 pixels of the target position. Even so, according to Amazon, the vendor's server-side verification rejected the deepfake in every recorded attempt. Meanwhile, another session built a real-time deepfake pipeline on a single consumer GPU using an open-source face animation model. By splitting the model and cutting down on memory copies, it hit 11.5 frames per second, close to what a live video check expects.

The ID photos were tampered with too. The agents generated fake camera metadata whose image dimensions matched the actual values in the JPEG file, and kept the camera's original compression tables, which would normally be replaced when the file is re-saved. That way, an edited image looks like an untouched camera photo at the file level. At least four agent sessions ran in parallel: one searched for cash-out routes, one drained account balances, one built the deepfake pipeline and one carried out the bypass.

Part of a bigger trend

Amazon's report isn't an isolated case. As a newsletter on note.com sums up, cloud security company Wiz published an analysis called "Black October" on October 30: at least nine AI developer platform providers reported breaches in October, including Fireworks AI, Lightning AI, OpenCode, Railway, Warp and Northflank. Zeabur shut down as a result. In every case, the attackers went looking for stored environment variables containing AI credentials. Abusing stolen AI keys like this is called "LLMjacking".

Wiz's numbers show how fast it happens. In one case, the first test call came about 30 minutes after the theft, followed by around 800,000 calls to Amazon Bedrock in roughly 30 hours, three quarters of them to Anthropic's Opus. In a second case, it was around 1.7 million calls in 13 hours. Wiz estimates the damage from both cases at more than 100,000 US dollars at list price, and found resale sites offering frontier models at a discount.

GBHackers reports on a similar case analyzed by researchers at VECERT. There, an agent automatically registered 1,438 accounts on the asset search engine fofa.info, searched for exposed .env files and stole OpenAI and DeepSeek keys. Among other things, the compute funded loyalty-points fraud and a database containing data on 5,132 students at a Shanghai university.

Our take

Amazon itself stresses that none of the techniques were new. What's new is the speed and persistence. The agents succeeded wherever basic security hygiene was missing: default passwords, keys in code and public packages, open endpoints, unpatched software. If you run AI gateways or tools like Open WebUI, LiteLLM or Ollama exposed to the internet, take this as a concrete warning. TechBooky recommends treating model gateways like production systems, removing default credentials, rotating exposed keys, limiting permissions and spending caps per key, and monitoring unusual costs as closely as suspicious logins. The fact that a region restriction significantly limited the damage in the Wiz case shows these measures work.

The report has its limits, though. Amazon only directly observed the requests hitting its own decoys, not the described attacks on other organizations. The results the agents reported about themselves haven't been verified. Both the attribution to ARTEX and to "various China-nexus groups" (based on Simplified Chinese in prompts, Chinese time zones and exclusion rules for targets in mainland China) carry only medium confidence. And at the crypto exchanges, the logs document a determined but failed attempt. Amazon has published indicators of compromise (IOCs), but warns: if you find no match in your own logs, that doesn't mean you're safe.