Hackers hijack AI accounts and servers to fuel new cyber crime boom

Recent coverage from outlets including CX Today, csoonline.com, Inshorts, 조선일보, and ft.com details a significant escalation in cybersecurity threats targeting artificial intelligence infrastructure. According to the reports, hackers are actively hijacking corporate AI accounts and servers to execute unauthorized operations. This activity includes stealing AI model access to sell on the dark web, misusing corporate clouds for free AI operations, and feeding a growing large language model proxy economy. A major supply chain attack has specifically exposed over 2,500 companies in what is being characterized as the largest artificial intelligence infrastructure breach recorded so far in the year 2026. The reporting across these publications places heavy emphasis on the mechanics of these breaches, which are increasingly referred to as LLM-jacking.

Outlets such as ft.com and csoonline.com highlight how stolen credentials are being monetized through proxy economies, while CX Today provides metrics regarding the vast scope of the supply chain compromise. 조선일보 and Inshorts focus on the operational aspects of the attacks, noting how unauthorized actors exploit corporate cloud environments to utilize artificial intelligence capabilities without incurring costs. Coverage does not yet specify the full extent of the financial damages incurred by the affected organizations or the exact identity of the threat actors behind the incidents. This trend emerges against the backdrop of rapidly expanding corporate adoption of artificial intelligence and large language models, creating new surfaces for attack that traditional security measures may not fully cover. As companies integrate sophisticated AI tools into their core supply chains and cloud infrastructures, these interconnected environments present lucrative targets for malicious actors. The exploitation of stolen credentials points to vulnerabilities in how organizations manage access permissions for complex machine learning resources.

Coverage does not yet detail the historical timeline of prior breaches or the specific preventative protocols currently being deployed by the thousands of impacted companies. Observers and stakeholders will need to monitor ongoing reports to see how affected firms respond to the supply chain exposures and whether security frameworks adapt to the rising LLM proxy economy. Further updates from outlets covering technology and business will likely track the evolution of LLM-jacking techniques and any potential regulatory or industry-wide interventions. Coverage does not yet specify concrete timelines for remediation efforts or whether law enforcement agencies have initiated formal investigations into the dark web markets where stolen AI access is currently being traded.