Post

A leaked access key used to mean someone spun up GPU instances on your buckets. Now the expensive thing is quieter: tokenmaxxing through Bedrock 😬 The case that stuck with me: $97,000 in 48 hours, around 2 million Bedrock tokens per minute, one long-lived key.

Tobias Schmidt

@tpschmidt.com

That is what I would fear most in an account hack today. Not the data leaving, the API turning a stolen key into a VERY large invoice. If your team does not use Bedrock, block it at the org level with an SCP. Then no leaked credential can spend there at all 😅

26/10/26, 7:57 am0 reposts0 likes

No replies yet.