---
title: An AI provider key (Bedrock, OpenAI, Anthropic and others) may be stolen: confirm abuse, cut it off, and keep the next one from fanning out | ctxsec
url: https://ctxsec.com/playbooks/stolen-ai-provider-key-llmjacking-response
---

[← Playbooks](/playbooks)

# An AI provider key (Bedrock, OpenAI, Anthropic and others) may be stolen: confirm abuse, cut it off, and keep the next one from fanning out

For LLMjacking after a platform or vendor breach (this month: Railway, OpenCode, Zeabur, Northflank). Built from Northflank's guidance and Wiz's Black October cases, where stolen Bedrock keys ran 800k to 1.7M calls within days.

For: Cloud / platform engineers, SOC, FinOps

[1. List every place the key lived](#s1)[2. Look for the abuse pattern](#s2)[3. Cut it off](#s3)[4. Limit the next key](#s4)[5. Report and recover](#s5)

1.

Step 1 of 5

__

### List every place the key lived

Start from where you stored it, not from what the vendor says was taken.

   - PaaS env vars and secret groups (Northflank, Railway and similar)
   - CI variables, agent and IDE config files, .env files on dev laptops
   - Gateways, proxies and routers that hold provider keys

2.

Step 2 of 5

__

### Look for the abuse pattern

Theft is usually followed by a single test call, quiet re-checks, then a flood.

   - AWS: CloudTrail InvokeModel/Converse from new IPs, ListInferenceProfiles, GetServiceQuota, EC2 quota lookups
   - Calls to models or regions you never use, especially global.* cross-region inference profiles
   - Spend spikes; many small cached-input calls with a few hundred output tokens (resold coding-agent traffic)
   - Wiz key-check IPs: 23.106.46.239, 38.246.114.118, 104.243.32.50, 31.57.201.201

3.

Step 3 of 5

__

### Cut it off

Revoke at the provider, then redeploy.

   - Revoke or deactivate the key or IAM access key at the provider; don't just change the stored value
   - Issue a replacement and update the workloads that need it
   - If abuse is ongoing, add an SCP or deny policy on bedrock:InvokeModel* for the principal while you investigate

4.

Step 4 of 5

__

### Limit the next key

Make a stolen key cheap.

   - Allow only the model IDs and inference profiles you use; deny global.* if you don't need it
   - Set budgets, quotas and spend alerts per key or account
   - One key per app or agent, so you can revoke one without breaking everything

5.

Step 5 of 5

__

### Report and recover

Providers can sometimes reverse fraudulent usage.

   - Report abuse to the provider with timestamps and IPs
   - Tell the platform that leaked the key (Northflank asks for reports to its support)
   - Record what was exposed for any customer or regulator notices

Original content by ctxsec. Printable checklist: use your browser's print view.