Jul 16, 2026Unverified
Three-person agency hit with a $14,000 AWS Bedrock bill after attackers burn stolen keys on Claude
AI loose in the worldAvailabilityDERIVED
Approved by person, Oct 11, 2026. How entries are approved
A three-person agency whose normal AWS bill ran $10 to $15 a month received a $14,000 charge in a single day after attackers extracted static access keys from an EC2 instance and used them to run Claude model invocations on Amazon Bedrock. Two defaults amplified the damage: the keys carried Bedrock Full Access, and AWS had removed its model-access toggle in 2025 so all models were enabled by default. The agency had expected a bill under $100 for its Bedrock chatbot. Reported by InfoQ.
What this means for youAt home, a stolen cloud key can run up AI charges fast, so check billing alerts. At work, small firms should set spending caps and rotate static keys. In government, agencies should require model access controls to be off by default.
Sources
- InfoQhttps://www.infoq.com/news/2026/07/ai-agents-billing-guardrails
Incident records from the AI Agent Incident Database by sipi.bot (https://sipi.bot/incidents/), licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/).
Source data license: CC BY 4.0. Attribution to sipi.bot is required.
Covered by snapshot 45
da93f03b406f409940d0a6ef47b526607f82ebf457d98f69299b88aceede576a
This entry is record number 2226. It has not been edited since it was approved; the hash above would not match if it had. How to verify