FT: dark web resells Anthropic, Google, OpenAI access at as low as 3% of list price
The FT reported on September 26 that Google Threat Intelligence found dark-web resellers offering stolen access to frontier AI models at up to 97% off, with some outfits offering "guaranteed access" replacements after bans.
IT Home on September 28 aggregated a Financial Times report from September 26 that illegal access to AI models and compute is rapidly becoming the most sought-after commodity on cybercrime black markets. John Hultquist, chief analyst at Google’s Threat Intelligence Group, disclosed that "LLM hijacking" activity has risen sharply this year, ranging from reselling stolen login credentials for public AI tools to groups stealing compute to run their own models for free.
Hultquist warned that attackers can use these expensive AI models at extremely low cost, gaining an edge in the cost equation: defenders have to pay full price to use the same tools to defend themselves, creating a structural asymmetry. Google Threat Intelligence researchers found dark-web markets reselling access to Anthropic, Google, and OpenAI models at up to 97 percent off list price.
Because AI labs monitor for abuse, some sellers advertise "guaranteed access" — if the original account gets banned, no extra fee is charged and a fresh set of credentials is provided. Some criminal groups and state-sponsored actors also break into enterprise cloud servers, drop their own AI models onto the victim’s infrastructure, and run models on the victim’s compute. Hultquist noted that as more enterprises move bespoke AI models onto their own servers rather than renting cloud compute, those self-hosted AI systems will increasingly become attack targets.