According to a report from the Financial Times, cybercriminals are increasingly trading stolen AI model access and computing power on the dark web. John Hultquist, chief analyst at Google's threat intelligence team, noted a significant rise in LLM hijacking, which involves selling stolen login credentials and unauthorized use of third-party computing resources.
The dark web market offers access to models from companies like OpenAI, Google, and Anthropic at discounts of up to 97 percent. For comparison, premium subscriptions for services like ChatGPT and Claude can cost up to $200 per user per month. Some sellers even provide a 'guaranteed access' service, offering free replacements if an initial account is banned by the AI provider.
Attackers are also compromising cloud-hosted servers to deploy their own AI models, effectively hijacking the victim's infrastructure. This tactic mirrors historical methods used for cryptojacking. Hultquist warns that as companies move to host custom AI models on their own servers to avoid high cloud costs, these private systems become primary targets for exploitation.
Businesses are currently in a phase of rapid AI adoption, which creates a 'noise' that allows attackers to hide their activities. Hultquist emphasizes that sudden spikes in computing usage might be dismissed as normal operational growth, providing a window of opportunity for hackers to infiltrate systems and leverage expensive AI resources at a fraction of the legitimate cost.
