From the source
Over the course of several days in October we detected and disrupted a highly automated cyber operation that had attempted to turn our AI software development platform into one node within a worldwide mesh of "off‑label" LLM usage.
The attackers used AI coding agents to generate and maintain their infrastructure, to adapt to our defenses in real time, and to orchestrate traffic from tens of thousands of synthetic organizations.
The goal of this attack was to exploit free compute at scale by chaining together free usage from multiple AI products and reselling that access and using it to mask a broad range of activity, including cyber‑crime.
This attack coincided with similar incidents across the industry, including those recently disclosed by Anthropic.
The methods and level of automation we observed have direct implications for how state‑linked and organized cybercriminals will operate in the future.
We are sharing what we saw, how we responded, and what we learned, in the hope that it helps others harden their own systems.
Detecting the initial attack …
