Google Threat Intelligence Group said in its latest quarterly AI Threat Tracker that intruders are now targeting AI credentials, source code, prompts, and proprietary models, then using victim cloud environments to run unauthorized AI workloads. GTIG also tied the trend to distillation campaigns, including more than 100 million prompts aimed at Google’s own image, audio, and video models.
The mechanism is straightforward: attackers are not just stealing AI files, they are taking the API credentials, login tokens, and cloud capacity that let them use the victim’s own compute as if it were theirs. That makes the compromise durable, because shutting the original entry point does not automatically revoke the access that keeps the AI jobs running.
For organizations that build or host AI assistants, RAG pipelines, or custom models, the exposure now sits in the credentials, quotas, and model stores that support those systems. If those controls are shared across teams or cloud projects, a breach can outlive the first intrusion and become a platform for espionage, extortion, or resource theft.
Securing the unpatchable in an age of AI-driven vulnerabilities
Advances in AI technology will continue to identify vulnerabilities that in some circumstances are difficult, or effectively impossible, to patch. Appropriate network segmentation, rigorous visibility, and the deployment of NGFW/IPS combinations can provide a powerful compensatory layer.