Amazon GuardDuty AI Protection: How to Catch the Attacker Running Up a $46,000 a Day Bedrock Bill
Most businesses adopting AI on AWS have moved faster than their security tooling. A team enables Amazon Bedrock, wires a model into a support workflow or an internal agent, and ships it in a fortnight. The security review that would have covered a new database or a new public endpoint never happens, because Bedrock does not feel like infrastructure. It feels like an API call. The problem is that an API call which bills by the token, and which can be reached by anyone holding a valid AWS credential, is one of the most attractive targets an attacker can find in your account. This month AWS made Amazon GuardDuty AI Protection generally available, and it exists precisely because that gap has become expensive.
The short answer is this. GuardDuty AI Protection extends GuardDuty’s threat detection to Amazon Bedrock and Amazon SageMaker by analysing CloudTrail management and data events from those services. It flags anomalous model invocations, cost harvesting attacks where a threat actor forces your account to burn GPU time and tokens, and prompt injection attempts surfaced through integration with Amazon Bedrock Guardrails. You enable it at the account or organisation level, it needs no agents and no custom tooling, and it starts producing findings against the AI workloads you already run. If you have Bedrock enabled in production and you cannot currently answer the question “would we know if someone else were using it”, this is the control that closes that gap.
Why AI Workloads Became the Cheapest Thing to Steal
Traditional cloud attacks need work. Cryptomining on stolen credentials means launching instances, which trips quota limits, service control policies, and cost anomaly alerts fairly quickly. Data exfiltration needs a target worth exfiltrating. Inference capacity is different. It is instantly monetisable, it leaves almost no infrastructure footprint, and the victim pays the bill.
Sysdig’s threat research team named this pattern LLMjacking in 2024, after observing attackers use credentials harvested from a vulnerable Laravel deployment to reach ten separate cloud hosted model services. Their arithmetic is worth repeating because it is doing the work here. At roughly 0.016 dollars per 1,000 tokens averaged across input and output, and at Bedrock’s rate limit of 500,000 tokens per minute, an attacker running at full quota across four regions generates 46,080 dollars of consumption per day. That is not a breach in the traditional sense. Nothing was stolen. You simply bought a very large quantity of inference for somebody else.
By 2026 this stopped being a research curiosity. The Cloud Security Alliance’s research note on Operation Bizarre Bazaar, drawing on joint Sysdig and Pillar Security work, describes a structured criminal supply chain: automated reconnaissance of exposed AI endpoints using Shodan and Censys, credential validation, and resale of confirmed access through an underground marketplace called silver.inc, which offers access to more than 30 LLM providers at 40 to 60 percent below the retail price the victim is being charged for the same capacity. CSA documented roughly 35,000 attack sessions against honeypot infrastructure between December 2025 and January 2026, an average of about 972 per day. Your Bedrock quota is now a commodity with a market price and a distribution channel.
The Numbers Worth Putting in Front of Your Board
Everything below traces to a named source. Where the research community disagrees, the disagreement is stated rather than smoothed over.
| Figure | Value | What it measures | Source |
|---|---|---|---|
| Modelled daily cost, Bedrock at full quota | 46,080 USD per day | Attacker consuming 500K tokens per minute at 0.016 USD per 1K tokens across four regions | Sysdig, LLMjacking |
| Upper commercial estimate, frontier models | Over 100,000 USD per day | Rate card analysis for highest tier models; not independently confirmed by primary research | CSA Research Note |
| Attack sessions observed | ~35,000 in Dec 2025 to Jan 2026 | Honeypot infrastructure exposing LLM endpoints, roughly 972 per day | CSA Research Note |
| Stolen inference resale discount | 40 to 60 percent below retail | silver.inc marketplace pricing across 30 plus LLM providers | CSA Research Note |
| Share of attack traffic aimed at MCP endpoints | 60 percent by late Jan 2026 | Pillar Security honeypot data, campaign distinct from the primary operation | CSA Research Note |
| Bedrock inference price used in the model | 0.008 USD per 1K input, 0.024 USD per 1K output | Basis for the 46,000 USD per day figure | Sysdig, LLMjacking |
Methodology note: figures were collected on 20 July 2026 from the AWS GuardDuty AI Protection announcement and documentation, Sysdig’s original and follow up LLMjacking research, the Cloud Security Alliance research note on Operation Bizarre Bazaar, and the AWS Security Blog post on Security Hub AI workload protection. The daily cost figures are modelled worst cases at maximum quota consumption, not observed averages across real victims, and the 100,000 USD figure is a commercial estimate that CSA itself flags as unconfirmed by primary research. Treat them as an upper bound on exposure rather than an expected loss.
What GuardDuty AI Protection Actually Detects
Three detection classes matter operationally. The first is anomalous invocation patterns. GuardDuty establishes a behavioural baseline for how your account normally calls Bedrock and SageMaker, then flags deviations: a model being invoked from a region you never use, a principal that has never touched Bedrock suddenly running inference at volume, or invocation rates that do not match any deployment you shipped. This is the detection that catches LLMjacking before the invoice does.
The second is cost harvesting. AWS is explicit that this is a distinct detection target, covering attacks where a threat actor deliberately drives GPU time and token consumption to inflate your bill or to resell the capacity. This is what the OWASP Top 10 for LLM Applications now classifies as unbounded consumption, the entry that replaced the older model denial of service category precisely because runaway cost, not downtime, turned out to be the real damage.
The third is prompt injection, surfaced through integration with Amazon Bedrock Guardrails. Prompt injection remains number one in the OWASP LLM Top 10 for the second consecutive edition, and the indirect variety is the dangerous one for businesses: your agent reads a support ticket, a scraped web page, or a customer supplied document, and follows instructions hidden inside it. If you are running Guardrails, GuardDuty can now turn those blocked attempts into security findings that flow into your normal alerting instead of sitting in a service log nobody reads.
AWS shipped a complementary piece at the same time. Security Hub now consumes AI workload posture findings alongside its existing coverage, and has expanded to monitor Microsoft Azure resources for misconfiguration, internet exposure, and vulnerabilities. For a scale-up that ended up multicloud by acquisition or by accident, that combination is the first time AI risk and cross-cloud posture land in one queue.
What to Do About It
Start by finding out what you actually have. Run a Bedrock and SageMaker inventory across every account and every region, including regions nobody remembers enabling, because the modelled 46,000 dollars a day assumes an attacker using regions you are not watching. Then enable GuardDuty AI Protection at the organisation level rather than per account, so new accounts inherit it by default.
Next, put a ceiling on the damage. GuardDuty tells you an attack is happening; service quotas and AWS Budgets actions decide how much it costs before you notice. Set Bedrock invocation quotas deliberately low in every region where you do not run production inference, and wire a budget action to alert on AI service spend at a threshold that is meaningful against your monthly run rate rather than a round number.
Then close the credential path, because LLMjacking is a credential problem wearing an AI costume. Long lived access keys with Bedrock permissions are the single highest risk artefact in most accounts. Move to IAM Identity Center and short lived credentials, scope Bedrock invoke permissions to the specific roles that need them, and audit anything that can call InvokeModel. If you expose MCP servers, treat any internet reachable server without authentication as a priority remediation. Sixty percent of observed attack traffic had shifted toward MCP endpoints by late January 2026, and an unauthenticated MCP server is a credential-free path to the same inference capacity.
Finally, make the findings someone’s job. A GuardDuty finding that lands in an unmonitored security account is not a control, it is a record of what you could have prevented. Route AI Protection findings into the same on-call path as your production alerts, and decide in advance who has the authority to revoke a key at two in the morning.
The pattern here is familiar to anyone who has watched a new AWS capability go from novelty to load bearing. Bedrock is no longer an experiment in most businesses. It is production, it is billed by consumption, and it is now attacked by people with a marketplace and a price list. GuardDuty AI Protection is AWS acknowledging that, and it takes about an afternoon to turn on.
If your team has AI workloads running on AWS and no clear answer to who could invoke them, HAZERCLOUD can help. We run AI workload security reviews and AWS cost exposure assessments for businesses across the UK, Europe and the US, covering GuardDuty and Security Hub configuration, IAM credential hygiene, Bedrock quota strategy and budget guardrails. Book a free consultation at https://hazercloud.com/contact/ and we will tell you what your current exposure looks like before an attacker does.
