Fortinet Reports AWS Bedrock LLMjacking via Leaked Administrator Key

Fortinet has reported an AWS intrusion in which a leaked, long-lived IAM access key with AdministratorAccess permissions was used to create a new IAM user, subscribe to foundation models through AWS Marketplace, and invoke them at the victim account’s expense. The case shows how LLMjacking turns cloud identity theft into paid model access without requiring the theft of model weights or training data. FortiGuard Labs documented the case on September 3, 2026.