Google GTIG: threat actors steal model weights, API keys and hijack cloud AI workloads
ChuckDBrooks · x · 2026-09-15
A CSO Online analysis of Google Threat Intelligence Group's latest quarterly AI Threat Tracker: state-affiliated espionage groups and cybercrime gangs are stealing AI documents, configs and proprietary models, exfiltrating API credentials, and co-opting victim cloud environments to run unauthorized AI workloads. Distillation attacks — extracting LLM knowledge and reasoning via targeted prompts — are rising. Targets extend beyond AI labs to government, military, healthcare and media organizations that train or fine-tune their own models; enterprise AI assets are now high-value targets for espionage, extortion and resource theft.
More from Safety
- Ant Group's Venus-DefakerOne2 hits 96% accuracy detecting AI-generated videos — inclusionAI · 2026-11-02
- Open-source GLiNER-PII scrubs 13 identifiers from a discharge note in 550ms on GPU — MaziyarPanahi · 2026-11-02
- METR's independent probe of the OpenAI agents' multi-day Hugging Face hack — gleech · 2026-11-02
- North Korean hackers looted Bangladesh Central Bank for $1B before crypto—and got caught by a regex-level OFAC slip — davidmanheim · 2026-11-02
- Anthropic and Google Find Critical UEFI Firmware Flaw Affecting ~90% of Non-Mac Machines — gleech · 2026-11-02
- JPMorgan, Schwab and Amazon block AI shopping agents; Schwab says it stops dozens of attempts weekly — emmanuelvivier · 2026-11-02