Three-person agency hit with a $14,000 AWS Bedrock bill after attackers burn stolen keys on Claude
Amazon Bedrock (customer: three-person agency) · Jul 16, 2026 · General agent
What happened
A three-person agency whose normal AWS bill ran $10 to $15 a month received a $14,000 charge in a single day after attackers extracted static access keys from an EC2 instance and used them to run Claude model invocations on Amazon Bedrock. Two defaults amplified the damage: the keys carried Bedrock Full Access, and AWS had removed its model-access toggle in 2025 so all models were enabled by default. The agency had expected a bill under $100 for its Bedrock chatbot. Reported by InfoQ.
Causal vector
Static AWS access keys exfiltrated from EC2, then burned on Bedrock Claude invocations with no spend cap or model-access restriction
Source
Reported by InfoQ. Verified against the primary report.
The $14,000 charge was the product of an unlimited, unmonitored credential against a metered model API. A velocity limit on Bedrock invocations and a daily total cap would have stopped the burn within minutes of the first anomalous call, and a category rule flagging a 1,000x jump in spend would have surfaced the incident the same hour instead of on the invoice.
The six rule types that contain this class of failure
Per-transaction cap
Any single spend above your ceiling is BLOCKED before it moves.
Daily total
Cumulative spend across all agent calls, bounded per day.
Velocity limit
Stops runaway retry loops — the #1 cause of overnight losses.
Merchant allowlist
Only approved destinations can ever receive funds.
Category rules
Flag high-risk classes (crypto, infra, refunds) for review.
Approval threshold
Above a value, the action waits for a human.
Related incidents
AWS user faces a $30K–$38K Bedrock bill that cost-anomaly detection never flagged
AWS Bedrock customer (individual developer) · May 14, 2026
Stolen Google Cloud API keys run up $3K–$127K Gemini bills for developers
Google Cloud customers (multiple developers) · May 13, 2026
Gartner: worldwide AI spending forecast at $2.52 trillion in 2026, up 44% YoY
Gartner / Portal26 · Jan 1, 2026
Don't be the next entry
Every incident in this database is the result of trusting a prompt, a provider cap, or a human review cycle. sipi.bot replaces all three with one deterministic call. 67 documented failures, one control.