Stolen EC2 keys burn $14,000 in a single day on Amazon Bedrock
anonymous three-person agency · Jul 16, 2026 · General agent
What happened
A three-person agency with a typical AWS bill of $10-$15/month received a $14,000 charge in a single day after attackers extracted static access keys from an EC2 instance and burned through Claude model invocations on Amazon Bedrock. The keys carried Bedrock Full Access, AWS had removed the model-access toggle in 2025 leaving all models enabled by default, and the application was designed to use Haiku with an expected bill under $100. Detection came from the credit card, not from AWS -- Cost Explorer lags up to 24 hours.
Causal vector
Static access keys on an EC2 instance plus full-access Bedrock defaults let attackers convert a stolen key into thousands of dollars of inference in hours
Source
Reported by InfoQ (citing Tobias Schmidt, AWS consultant, LinkedIn post). Verified against the primary report.
A merchant allowlist scoped to the single model the application actually calls -- Haiku -- returns BLOCKED on any invocation of a more expensive model, so a stolen key cannot be weaponized against the full Bedrock catalogue. Short-lived IAM roles instead of static keys remove the exposure entirely.
The six rule types that contain this class of failure
Per-transaction cap
Any single spend above your ceiling is BLOCKED before it moves.
Daily total
Cumulative spend across all agent calls, bounded per day.
Velocity limit
Stops runaway retry loops — the #1 cause of overnight losses.
Merchant allowlist
Only approved destinations can ever receive funds.
Category rules
Flag high-risk classes (crypto, infra, refunds) for review.
Approval threshold
Above a value, the action waits for a human.
Related incidents
15 malicious JetBrains plugins silently exfiltrated developers' OpenAI, DeepSeek and SiliconFlow API keys
JetBrains Marketplace (third-party plugin authors) · Jun 10, 2026
Compromised LiteLLM PyPI packages harvest credentials via supply-chain attack
LiteLLM (BerriAI) · Mar 24, 2026
Step Finance treasury drained in $27–40M exploit
Step Finance · Jan 31, 2026
Don't be the next entry
Every incident in this database is the result of trusting a prompt, a provider cap, or a human review cycle. sipi.bot replaces all three with one deterministic call. 85 documented failures, one control.