[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Playbooks

An AI provider key (Bedrock, OpenAI, Anthropic and others) may be stolen: confirm abuse, cut it off, and keep the next one from fanning out

For LLMjacking after a platform or vendor breach (this month: Railway, OpenCode, Zeabur, Northflank). Built from Northflank's guidance and Wiz's Black October cases, where stolen Bedrock keys ran 800k to 1.7M calls within days.

For: Cloud / platform engineers, SOC, FinOps

1. List every place the key lived2. Look for the abuse pattern3. Cut it off4. Limit the next key5. Report and recover
  1. Step 1 of 5

    List every place the key lived

    Start from where you stored it, not from what the vendor says was taken.

    • PaaS env vars and secret groups (Northflank, Railway and similar)
    • CI variables, agent and IDE config files, .env files on dev laptops
    • Gateways, proxies and routers that hold provider keys
  2. Step 2 of 5

    Look for the abuse pattern

    Theft is usually followed by a single test call, quiet re-checks, then a flood.

    • AWS: CloudTrail InvokeModel/Converse from new IPs, ListInferenceProfiles, GetServiceQuota, EC2 quota lookups
    • Calls to models or regions you never use, especially global.* cross-region inference profiles
    • Spend spikes; many small cached-input calls with a few hundred output tokens (resold coding-agent traffic)
    • Wiz key-check IPs: 23.106.46.239, 38.246.114.118, 104.243.32.50, 31.57.201.201
  3. Step 3 of 5

    Cut it off

    Revoke at the provider, then redeploy.

    • Revoke or deactivate the key or IAM access key at the provider; don't just change the stored value
    • Issue a replacement and update the workloads that need it
    • If abuse is ongoing, add an SCP or deny policy on bedrock:InvokeModel* for the principal while you investigate
  4. Step 4 of 5

    Limit the next key

    Make a stolen key cheap.

    • Allow only the model IDs and inference profiles you use; deny global.* if you don't need it
    • Set budgets, quotas and spend alerts per key or account
    • One key per app or agent, so you can revoke one without breaking everything
  5. Step 5 of 5

    Report and recover

    Providers can sometimes reverse fraudulent usage.

    • Report abuse to the provider with timestamps and IPs
    • Tell the platform that leaked the key (Northflank asks for reports to its support)
    • Record what was exposed for any customer or regulator notices

Original content by ctxsec. Printable checklist: use your browser's print view.