Wiz reconstructs an initial model-access test, periodic key validity checks and a later model catalog probe before a bulk inference campaign. The first customer credential allowed global cross-region inference profiles, spreading demand and reducing throttling. This is one of two distinct Bedrock credential abuse examples, not 800,000 separate compromises.…
Inspect the ClaimsCase · DiggingBeagle record
Wiz Case A: a stolen Bedrock key generated about 800,000 calls in 30 hours
Wiz observed roughly 800,000 unauthorized Amazon Bedrock requests over thirty hours for one stolen customer credential, with approximately 90 percent succeeding.
Scope
A single Wiz-observed credential and one follow-on traffic campaign; no proof of which entity originally exfiltrated the key or how much data it saw.
Assessment profile
Assessment method- Setting
- production
- Exploitation
- confirmed in the wild
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
Wiz reported first-party incident telemetry for one compromised customer credential and approximately 800,000 unauthorized requests over thirty hours. A request is a billable action, not a distinct compromised account, and resale attribution remains separate. Impact remains unrated because the evidence does not supply a calibrated scale for this Case.
Assessed Nov 1, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-2026-NOV01-BEDROCK-LLMJACK-A-1 · Wiz: Black October for AI Developer Platforms and downstream Bedrock key abuse
At a glance
Assess the reported tool or model action separately from the side effect actually observed.
Read the implicationsA single Wiz-observed credential and one follow-on traffic campaign; no proof of which entity originally exfiltrated the key or how much data it saw.
Limits and uncertaintyFull account
Wiz reconstructs an initial model-access test, periodic key validity checks and a later model catalog probe before a bulk inference campaign. The first customer credential allowed global cross-region inference profiles, spreading demand and reducing throttling. This is one of two distinct Bedrock credential abuse examples, not 800,000 separate compromises. Attribution to a specific resale operator or the original platform intrusion remains limited.
The abused asset was a provider credential that could fund inference, not a host-level compromise during each request. Cross-region inference profiles can increase allowed model capacity under the same credential; a response must therefore disable or narrow the credential itself as well as review anomalous volume. The reported model calls do not reveal how the key was first stolen.
Mechanism and trust boundary
- 01
Step
Claims & evidence
CLM-2026-NOV01-BEDROCK-LLMJACK-A-1Wiz observed roughly 800,000 unauthorized Amazon Bedrock requests over thirty hours for one stolen customer credential, with approximately 90 percent succeeding.supported
Basis: reported finding
- supportsWiz: Black October for AI Developer Platforms and downstream Bedrock key abuseprimary disclosure
Wiz Black October, Impact and Follow-on activity, Case A, The Flood and stolen token profile
Implications
Assess the reported tool or model action separately from the side effect actually observed.
Controls and mitigations
- Revoke stolen credentials, limit model and regional inference permissions, alert on abnormal model enumeration and request velocity, and set provider-side cost controls.
Unknowns and contradictions
- A single Wiz-observed credential and one follow-on traffic campaign; no proof of which entity originally exfiltrated the key or how much data it saw.
Sources and citation
Material revision history
- Nov 1, 2026 · Canonical change recorded · new in release · revision 211