80,000+ Organizations Had AI Logins Stolen: From Shadow AI to LLMjacking

Summary

SOCRadar's AI Identity Exposure Report analyzed more than one million infostealer records tied to AI services and narrowed them to 482 major enterprises. It found 5,434 stealer-log records tied to 1,500 corporate email addresses, with ChatGPT or OpenAI sessions appearing for 358 of the 482 companies. The report argues that a stolen AI login exposes conversation history, replayable session cookies that bypass MFA, agent OAuth grants, and billable API keys.

Related items

• InfoQuoting The New York TimesSame vendor · Simon Willison's Weblog
• InfoAnthropic’s AI gave Philadelphia police a fake tip about an unsolved homicideSame vendor · The Verge (AI)
• InfoOpenAI Fires 3 Safety Researchers in Dispute Over AI RisksSame vendor · SecurityWeek
• MediumHackers abuse Google Ads, Bing redirects to push Claude ClickFix attacksSame vendor · BleepingComputer
• Info‘Pure insanity’: Mathematicians will need years to make sense of OpenAI’s latest dropSame vendor · The Verge (AI)