Amazon Finds AI Agents Stealing Keys to Fund Cyberattacks

AI agents are no longer only tools that defenders use to find weaknesses. In an investigation published on 13 November, Amazon Threat Intelligence said it had captured records from offensive AI agents that were hunting credentials, probing cloud services and attempting to defeat identity checks at cryptocurrency exchanges.

The most striking finding is a potential feedback loop. In one campaign, the attackers instructed agents to find working keys for premium AI models. Those keys could then be added to the framework’s model gateway, allowing the operation to keep running at someone else’s expense while it searched for more credentials.

Amazon’s MadPot network consists of controlled decoy services that record suspicious activity. Between 3 October and 5 November, some sensors posing as AI inference interfaces received requests from agents using what Amazon assessed, with moderate confidence, to be the open-source ARTEX penetration-testing framework. The requests contained persistent task context, instructions and histories. That gave researchers an unusual view into how the operations were organised.

The records described agents dividing work among planners, workers and verification components, then sharing findings through a common memory. They searched public code repositories, software packages and exposed AI applications for secrets. They tested whether keys worked, examined what those keys could reach and prioritised credentials that could run expensive models. A weakly secured AI gateway was attractive because it might expose access to several downstream providers at once.

Amazon said a separate set of agent records showed attempts to bypass know-your-customer checks at two cryptocurrency exchanges using forged documents and real-time deepfake video. The recorded liveness attempts were rejected by a vendor’s server-side checks. That detail matters because the evidence shows a determined attempt, not a demonstrated successful bypass of those checks.

Amazon directly observed the requests made to its decoys, but it did not witness every action described in the agents’ histories. It says activity against other organisations could not always be confirmed. Its attribution to disparate Chinese-nexus groups is also an assessment made with moderate confidence, not a conclusive identification of operators. Reporting those limits is essential to understanding the case.

Even with those caveats, the findings are significant. The reported behaviour is not a futuristic exploit that defeats every defence. It is an automated way to pursue familiar weaknesses persistently: default credentials, unpatched software, publicly exposed secrets and poorly protected management interfaces. When an agent can keep testing and recording results, the window between an accidental exposure and attempted abuse may become shorter.

For organisations building AI products, the practical response begins with treating model gateways and inference endpoints as production infrastructure. Audit the services reachable from the internet, remove default credentials, rotate exposed keys and limit each token’s permissions and spending. Monitor unusual model usage and costs as closely as suspicious logins. Amazon published indicators that security teams can compare with their own logs, while warning that absence of a match does not prove an environment is safe.

The broader lesson is that access to AI models is now an asset attackers may steal to finance more attacks. As TechBooky has previously explored in its coverage of cloud resilience and fintech security, location alone does not protect a system. The quality of access controls, monitoring and incident response matters more when automated probes can run continuously.