Home
Dark Web AI Computing Power Rush: Top Accounts at 30% Discount, Stolen Models Used for Attacks

The illicit acquisition of AI models and computing resources is surging to the top of underground market "most wanted" lists. Cybercriminals are increasingly leveraging these costly large language models for ransomware campaigns, cyber warfare, and espionage.
John Hultquist, chief analyst at Google's Threat Intelligence Group, noted a sharp rise in "LLM hijacking" incidents this year. Attackers are either selling stolen credentials for public AI platforms or directly stealing computing power to run their own models at no cost. With two decades of security experience, Hultquist observes that an "AI access economy" is expanding rapidly within underground circles.
Deep Discounts on Premium Accounts with Ban Guarantees
Securing affordable access to expensive AI tools allows attackers to financially outmatch defenders, who must also invest in the same technologies for protection. Hultquist highlights that these actors are acquiring tokens at significantly reduced rates.
Google's research reveals dark web vendors offering access to models from Anthropic, Google, and OpenAI with discounts reaching 97%. While premium subscriptions for ChatGPT and Claude can cost up to $200 monthly per user, these are sold at steep markdowns. To counter AI labs' abuse detection, some sellers provide "guaranteed access," offering free replacement credentials if an account is banned.
A more aggressive tactic involves criminal syndicates or state-sponsored groups directly attacking cloud-hosted servers to install and run their own models. This mirrors past tactics where hackers compromised third-party machines for cryptocurrency mining. Hultquist asserts that AI is now utilized by "all threat actors" and will inevitably become a core component of security infrastructure.
Emerging Threats: Building Custom Compute and Hiding in Plain Sight
Anthropic's latest abuse report indicates that actors from over 20 countries, including the U.S., UK, and Yemen, are attempting to misuse Claude for malicious ends. Hultquist warns that dismissing AI as a fleeting trend is dangerous; security incidents, alerts, and attacks will only intensify. "You need to secure your own infrastructure now," he advises.
Related article
Nvidia H200 China deal survives Trump-Xi summit, but not as expected
President Trump traveled to Beijing with Jensen Huang joining the delegation at the eleventh hour, departing two days later with vague remarks about potential chip export developments. No deal materialized. Since Trump first authorized sales in Decem
How to fix Core Web Vitals for SEO ranking?
Creating visually appealing assets is crucial in game development. Pixel art, with its charming retro aesthetic, remains a popular choice. With the advent of AI tools, generating pixel art has become more accessible than ever. This guide explores how
TechCrunch Disrupt 2026 breakout session agenda unveiled
TechCrunch Disrupt 2026 arrives at Moscone West in San Francisco, October 13–15, uniting 10,000+ founders, investors, operators, and tech leaders for three days of insight, networking, and forward-looking dialogue. Register now to save up to $100 on
Related Special Topic Recommendations
Comments (0)
0/500

The illicit acquisition of AI models and computing resources is surging to the top of underground market "most wanted" lists. Cybercriminals are increasingly leveraging these costly large language models for ransomware campaigns, cyber warfare, and espionage.
John Hultquist, chief analyst at Google's Threat Intelligence Group, noted a sharp rise in "LLM hijacking" incidents this year. Attackers are either selling stolen credentials for public AI platforms or directly stealing computing power to run their own models at no cost. With two decades of security experience, Hultquist observes that an "AI access economy" is expanding rapidly within underground circles.
Deep Discounts on Premium Accounts with Ban Guarantees
Securing affordable access to expensive AI tools allows attackers to financially outmatch defenders, who must also invest in the same technologies for protection. Hultquist highlights that these actors are acquiring tokens at significantly reduced rates.
Google's research reveals dark web vendors offering access to models from Anthropic, Google, and OpenAI with discounts reaching 97%. While premium subscriptions for ChatGPT and Claude can cost up to $200 monthly per user, these are sold at steep markdowns. To counter AI labs' abuse detection, some sellers provide "guaranteed access," offering free replacement credentials if an account is banned.
A more aggressive tactic involves criminal syndicates or state-sponsored groups directly attacking cloud-hosted servers to install and run their own models. This mirrors past tactics where hackers compromised third-party machines for cryptocurrency mining. Hultquist asserts that AI is now utilized by "all threat actors" and will inevitably become a core component of security infrastructure.
Emerging Threats: Building Custom Compute and Hiding in Plain Sight
Anthropic's latest abuse report indicates that actors from over 20 countries, including the U.S., UK, and Yemen, are attempting to misuse Claude for malicious ends. Hultquist warns that dismissing AI as a fleeting trend is dangerous; security incidents, alerts, and attacks will only intensify. "You need to secure your own infrastructure now," he advises.
Nvidia H200 China deal survives Trump-Xi summit, but not as expected
President Trump traveled to Beijing with Jensen Huang joining the delegation at the eleventh hour, departing two days later with vague remarks about potential chip export developments. No deal materialized. Since Trump first authorized sales in Decem
How to fix Core Web Vitals for SEO ranking?
Creating visually appealing assets is crucial in game development. Pixel art, with its charming retro aesthetic, remains a popular choice. With the advent of AI tools, generating pixel art has become more accessible than ever. This guide explores how
TechCrunch Disrupt 2026 breakout session agenda unveiled
TechCrunch Disrupt 2026 arrives at Moscone West in San Francisco, October 13–15, uniting 10,000+ founders, investors, operators, and tech leaders for three days of insight, networking, and forward-looking dialogue. Register now to save up to $100 on











