AI Compute Hijacking Targets GPU Clusters with 300% Rise in Unauthorized Workloads

Cloud telemetry from major providers shows unauthorized GPU utilization spikes tied to AI workloads, distinct from traditional cryptojacking. Attackers exploit misconfigured IAM roles and container escapes to spawn inference jobs that evade detection by blending with legitimate customer traffic. Procurement records reveal hyperscalers accelerated GPU allocation without corresponding security controls on resource attestation.

This vector connects directly to documented sandbox weaknesses in AI tooling, where local execution primitives allow escalation to cluster-level access. Patterns in contract awards indicate defense and research entities are prioritizing compute scale over isolation hardening, creating the exact conditions exploited here. Official incident reports remain sparse because billing anomalies are classified as customer errors rather than intrusions.

Independent analysis of similar incidents shows China-linked actors testing these methods alongside RAT frameworks that use DoH for C2. The gap between marketing claims of secure AI platforms and actual procurement specifications for attestation hardware continues to widen.

Next quarter will likely see public disclosures from at least two major cloud AI platforms after internal thresholds for anomalous GPU hours are crossed.