Protect your organisations’ AI services

What is affected, what to do

Listen warning Advisory Protect your organisations’ AI services Protect access to AI services by securing accounts, credentials and connected systems to reduce the risk of unauthorised use, disruption and data exposure. Published 29 Sep 2026 Last reviewed 29 Sep 2026 | <button class="page-header__print-link" type="button" aria-expanded="false" aria-controls="page-header-print-menu" data-header-menu-trigger > print Print page Print page <button class="page-header__share-link" type="button" aria-expanded="false" aria-controls="page-header-share-menu" data-header-menu-trigger > email Email or share link chevron_right <a href="https://twitter.com/intent/tweet?text=https%3A%2F%2Fwww.cyber.gov.au%2Fadvisory%2Fprotect-your-organisations-ai-services" class="page-header__icon-link" role="menuitem" target="_blank" rel="noopener noreferrer" data-share-network="x" aria-label="Share on X" > <a href="https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.cyber.gov.au%2Fadvisory%2Fprotect-your-organisations-ai-services"e=https%3A%2F%2Fwww.cyber.gov.au%2Fadvisory%2Fprotect-your-organisations-ai-services" class="page-header__icon-link" role="menuitem" target="_blank" rel="noopener noreferrer" data-share-network="facebook" aria-label="Share on Facebook" > <a href="https://www.linkedin.com/feed/?shareActive=true&text=https%3A%2F%2Fwww.cyber.gov.au%2Fadvisory%2Fprotect-your-organisations-ai-services" class="page-header__icon-link" role="menuitem" target="_blank" rel="noopener noreferrer" data-share-network="linkedin" aria-label="Share on LinkedIn" > <a href="mailto:?subject=Protect%20your%20organisations%E2%80%99%20AI%20services&body=https%3A%2F%2Fwww.cyber.gov.au%2Fadvisory%2Fprotect-your-organisations-ai-services" class="page-header__icon-link" role="menuitem" data-share-network="email" data-share-subject="Protect your organisations’ AI services" aria-label="Share by email" > <button class="page-header__print-share-link" type="button" aria-expanded="false" aria-controls="page-header-mobile-menu" data-header-menu-trigger > Print or share chevron_right Print page <img data-component-id="cybergovau:image" class="cga-image page-header__image cga-image--lazy cga-image--banner cga-image--responsive" loading="lazy" data-image-style="banner" src="/themes/custom/cybergovau/assets/images/page-header.svg" alt="" > eye_tracking At a glance Calculating...

The available sources name no fixed version. Check the vendor guidance in the references below.

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Handle the vulnerability in regular vulnerability handling under Art. 21(2)(e) NIS2.

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

From 11.12.2027, Annex I Part II CRA requires manufacturers of affected products with digital elements to handle vulnerabilities without delay and provide security updates.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Listen warning Advisory Protect your organisations’ AI services Protect access to AI services by securing accounts, credentials and connected systems to reduce the risk of unauthorised use, disruption and data exposure. Published 29 Sep 2026 Last reviewed 29 Sep 2026 | <button class="page-header__print-link" type="button" aria-expanded="false" aria-controls="page-header-print-menu" data-header-menu-trigger > print Print page Print page <button class="page-header__share-link" type="button" aria-expanded="false" aria-controls="page-header-share-menu" data-header-menu-trigger > email Email or share link chevron_right <a href="https://twitter.com/intent/tweet?text=https%3A%2F%2Fwww.cyber.gov.au%2Fadvisory%2Fprotect-your-organisations-ai-services" class="page-header__icon-link" role="menuitem" target="_blank" rel="noopener noreferrer" data-share-network="x" aria-label="Share on X" > <a href="https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.cyber.gov.au%2Fadvisory%2Fprotect-your-organisations-ai-services"e=https%3A%2F%2Fwww.cyber.gov.au%2Fadvisory%2Fprotect-your-organisations-ai-services" class="page-header__icon-link" role="menuitem" target="_blank" rel="noopener noreferrer" data-share-network="facebook" aria-label="Share on Facebook" > <a href="https://www.linkedin.com/feed/?shareActive=true&text=https%3A%2F%2Fwww.cyber.gov.au%2Fadvisory%2Fprotect-your-organisations-ai-services" class="page-header__icon-link" role="menuitem" target="_blank" rel="noopener noreferrer" data-share-network="linkedin" aria-label="Share on LinkedIn" > <a href="mailto:?subject=Protect%20your%20organisations%E2%80%99%20AI%20services&body=https%3A%2F%2Fwww.cyber.gov.au%2Fadvisory%2Fprotect-your-organisations-ai-services" class="page-header__icon-link" role="menuitem" data-share-network="email" data-share-subject="Protect your organisations’ AI services" aria-label="Share by email" > <button class="page-header__print-share-link" type="button" aria-expanded="false" aria-controls="page-header-mobile-menu" data-header-menu-trigger > Print or share chevron_right Print page <img data-component-id="cybergovau:image" class="cga-image page-header__image cga-image--lazy cga-image--banner cga-image--responsive" loading="lazy" data-image-style="banner" src="/themes/custom/cybergovau/assets/images/page-header.svg" alt="" > eye_tracking At a glance Calculating... Malicious cyber actors are obtaining unauthorised access to organisations' AI services through compromised credentials, authentication tokens, user sessions, vulnerable applications and third-party access arrangements. This access can be used to generate harmful content, consume service credits, disrupt legitimate work and access connected systems or data. Organisations should treat access to advanced AI services as a security-sensitive asset and apply strong security controls beyond those provided by the AI developer. This advisory outlines practical measures to protect AI accounts, credentials, applications and third-party access. check_box Key actions Maintain an inventory of AI accounts, service identities and credentials, and apply least-privilege access. Protect AI accounts with phishing-resistant MFA and secure API keys using approved secrets-management services. Monitor AI usage, credential changes and unusual activity, and enforce tested spending and rate limits. Revoke compromised credentials, preserve logs and investigate suspected unauthorised access before restoring services. ASD is aware that malicious cyber actors are obtaining unauthorised access to organisations' AI services through compromised API keys, stolen authentication tokens, compromised user sessions, vulnerable applications and third-party access arrangements. This access can enable unauthorised usage to create harmful material, distill model capabilities, exhaust available credits and disrupt legitimate work. Organisations should treat access to advanced AI services as a security-sensitive asset. Protecting that access requires more than relying on the AI developer's security controls. The organisation's accounts, devices, applications and third-party arrangements also need to be secured. How organisations can reduce the risk Assign ownership and apply least privilege Maintain an inventory of AI accounts, service identities and credentials, assign an accountable owner to each, grant only the access required, and promptly remove unnecessary access. Protect accounts and credentials Require phishing-resistant MFA, use managed and patched devices, monitor for suspicious session activity, and secure API keys using approved secrets-management services. Restrict access to systems that require them and prevent credentials from being exposed in code, documents, logs or prompts. Separate restricted access and third-party use Keep restricted-model access and sensitive data separate from routine AI use and experimental environments. Apply security review before exposing applications externally and provide suppliers with limited, auditable access. Monitor activity and enforce limits Monitor model access, credential creation, permission changes and unusual usage patterns. Protect audit logs from tampering and configure tested spending, rate and consumption limits that enforce restrictions rather than only generating alerts. Respond quickly to suspected compromise Revoke affected API keys, sessions and tokens, isolate compromised devices, preserve logs and investigate unauthorised changes. Remediate the underlying cause before restoring access. How an organisation's AI access can be compromised API keys can be exposed in source-code repositories, application configuration files or browser extensions. Vulnerable agent dashboards and other internet-facing applications can also expose credentials used to call model-provider services. An attacker who obtains a working key may then make requests independently of the organisation's legitimate application. Phishing, information-stealing malware and compromised third-party services provide additional routes to account credentials and authentication tokens. A stolen browser session may allow an attacker to act as an already-authenticated user without completing a fresh multi-factor authentication challenge. Suppliers and contractors can introduce similar risks where they hold organisational credentials or delegated access. The impact depends on the permissions attached to the compromised identity. Permission to use a model is different from permission to administer an account, create credentials or access stored files. Organisations should assess these privileges separately and avoid assuming that a key used for a simple application has appropriately limited access. Organisations should also consider the downstream access available through AI agents. A compromised user session, account or agent may be able to interact with connected enterprise systems, invoke tools, access organisational data, or communicate with other agents on the user's behalf. As a result, the practical impact of a compromise may extend beyond the permissions directly assigned to the affected credential. Recent reports highlight the risks On 9 September 2026, The Hacker News reported research from Okta that identified still-valid AI API keys and unexpired authentication tokens in data stolen from infected computers. On 1 September 2026, The Register reported that an attacker spent three weeks consuming public-model credits worth approximately US$600,000. METR's disclosure described an incident in which an authentication flaw in an internet-facing agent dashboard enabled theft of a model-provider API key. On 21 April 2026, Reuters, citing Bloomberg, reported that unauthorised users had accessed Claude Mythos Preview, which was then restricted to selected organisations. This was reporting about alleged unauthorised access through a vendor environment, rather than confirmation that the model developer’s core infrastructure had been compromised. Related content menu_book Publication Strategies to mitigate cyber security incidents Prioritise and implement cyber security controls to protect your organisation from common cyber threats. arrow_forward web Landing page Submit a Report Report a cybercrime, incident, vulnerability or ransomware payment. arrow_forward

Source: ASD ACSC (CC BY 4.0)