Stolen AI Keys: Why Agent-Speed Cloud Bills Beat Guardrails

A $14,000 day for a $15-a-month customer

The clearest recent example of how AI economics can turn against a small business comes from a three-person agency. Its AWS bill normally ran between $10 and $15 a month. Then it received a $14,000 charge in a single day. 1 Attackers had extracted static access keys from an EC2 instance and used them to run Claude model invocations on Amazon Bedrock. 1

AWS consultant Tobias Schmidt described the incident publicly. The team had been experimenting with a Bedrock chatbot using access keys it already had. 1 Two defaults made the damage much worse. The keys carried Bedrock Full Access, and AWS had removed its per-model access toggle in 2025, which left every model enabled by default. 1 The agency's application was built around Haiku, a cheaper model, with expected costs under $100. 1 Once the keys leaked, though, nothing restricted the attackers to the model the agency intended to use.

Not an isolated case

InfoQ connects this incident to an earlier one in May involving DN42, in which an autonomous agent provisioned $6,531 of oversized infrastructure within 24 hours. 1 Help Net Security, reporting on Mandiant's latest AI Risk and Resilience report, highlights a single runaway agent that reportedly produced a $50,000 cloud bill. 4 The incidents involve different dollar amounts and different causes. One was outright credential theft and the others were agents acting on their own. All of them, however, show spending that grew far faster than anyone could respond to it.

Practitioners quoted by InfoQ identify the structural problem. Cloud billing data runs roughly a day behind spend that now happens at agent speed. 1 Budget alerts and anomaly detection were built for human-scale mistakes, such as a forgotten instance or a misconfigured autoscaler. By the time they fire, a machine-speed workload may already have run for hours.

Attackers have noticed

The security side of the story is getting sharper. Mandiant's report, which draws on its own observations and those of Google Threat Intelligence Group, warns that a poisoned data source, model dependency, or extension hook can turn a trusted agent into a channel for internal reconnaissance, lateral movement, or escape from a sandbox. 4 It also describes adversaries building middleware, proxy relays, and automated registration systems to get around safety guardrails and billing limits on commercial AI platforms. 4

That matters for the agency case. Stolen keys that can call frontier models have direct resale and resource value, much as stolen compute was once used to mine cryptocurrency. Forcepoint, cited by TechRadar, makes a similar warning: attackers could exploit uncontrolled AI to drive up a victim's costs. 2 TechRadar also quotes the point that security teams rarely watch cloud billing, which is exactly the gap this kind of abuse depends on. 2

The slower-burning cost problem

Not every runaway bill involves an adversary. Forcepoint's research argues that agentic AI, if left without limits, can consume excessive compute, tokens, and API calls. A single prompt can set off a large amount of downstream work. 2 A Forbes Council post calls this the "agentic cloud tax." It describes indirect infrastructure costs that pile up as agents call APIs, query databases, invoke other models, trigger workflows, and hand tasks to other agents. 3 The author argues organizations are not yet measuring this category effectively. 3

The sources mostly agree on remedies, though they stress different layers:

• Finer-grained budgets. Forcepoint recommends setting budgets per API key, per user, and per team, along with better visibility into where costs are attributed. 2
• Circuit breakers. Forcepoint also calls for agentic circuit breakers to stop workloads and costs from compounding. 2
• Dynamic guardrails. The Forbes piece argues that static controls such as quotas and architecture standards will need runtime equivalents that can steer an agent's behavior while it is still operating. 3
• Causal attribution. The same piece describes FinOps moving from tracking resource costs to tracing a chain of agent activity back to the business outcome that started it. 3

The takeaway

It is tempting to file these stories under FinOps, but the agency incident shows this is first a security problem. Long-lived static keys, broad permissions like Bedrock Full Access, and every model enabled by default together created a large blast radius. 1 Better dashboards would not have prevented it. Scoping credentials to a single model and replacing static keys with short-lived ones would have shrunk the damage significantly.

The wider lesson is that cost has become an attack surface. When monitoring lags about a day behind spending, organizations cannot rely on catching problems after the fact. The controls have to be preventive: hard spending caps, least-privilege model access, and kill switches that act within minutes. Until cloud providers offer real-time billing enforcement by default, small teams experimenting with AI are the most exposed, because a single leaked key can cost more than years of their normal bills.