A hacking tool has been caught that does not bring its own AI. It scans the internet for AI models that anyone can talk to, takes one over, and gives it orders. The model then looks for more targets, breaks into servers with known weaknesses, steals passwords and databases, and hides cryptocurrency mining software on the machines it enters. Its instructions allow up to 100,000 steps in a row without a human approving any of them.
The tool came to light because its operators sent their full instructions to a decoy server built to look like an open AI service. The decoy never ran anything, so what researchers saw was the plan, not a victim's bill. The plan is still enough to show where this is going.
The bill lands on the owner by design
Every step the agent takes is a request to the model, and models are billed by use. At a cent a step, 100,000 steps cost $1,000. At ten cents, they cost $10,000. The attacker pays none of it.
A stolen key can also use up the owner's quota, which can block the owner from using the models for their own work. So a hijacked account can mean a large bill and a broken product at the same time.
Finding victims is cheap too. Most AI tools now talk in the same standard way, so one scanner finds home-built model servers, gateways in front of paid company accounts, and quick test systems alike. Roughly 175,000 servers running one popular program for self-hosted AI models have been reachable from the internet, because a single setting is all it takes to open one.
A jailbreak does not have to work every time
Commercial models are built to refuse this work, so the operators wrap their orders in five layers. The model is given a fake name, told that stealing passwords is ordinary developer work, handed a companion character that treats any refusal as a betrayal, and told to ignore its own warnings. Only then does it get 74 attack tools. Whether it fully beats current models is not established.
It may not need to. When a failed attempt costs the attacker nothing, a trick that works one time in twenty is plenty, because the attacker can try it on thousands of exposed models. The weakness underneath is one we wrote about before: a model cannot see who is really asking, so a story about routine development work can be enough to get it to act.
Each break-in can pay for the next
The tool also searches for more open endpoints and leaked keys, and its miners earn money from every server it takes. One success can therefore fund the search for the next. None of the individual techniques is new. What is new is that nobody has to run the campaign by hand, so the number of attacks depends on how many exposed AI tools exist, not on how many criminals are willing to work.
That number will keep growing, because more small teams are building their own AI tools. A new AI service that is reachable from the internet should be treated as if it will be found and tried within hours.
What an owner of an AI tool should do now
If you or your team built anything that calls an AI model, set a spending limit and an alert on the AI account, so a sudden jump shows up the same day. Keep the keys out of code files and shared documents. Put a password on any model server before it is reachable from outside, and ask who set up the test server that nobody uses any more. An unusual bill is often the first sign that someone else is using your model.