Your AI Logins Are Now a Target: What ASD Says to Do

AI subscriptions are now something attackers want to steal. On 29 September the Australian Signals Directorate (ASD) published Protect your organisation's AI services. It describes attackers getting into organisations' AI services through compromised API keys, stolen login tokens and hijacked sessions.

One case in the advisory involved an attacker using about US$600,000 of AI credits over three weeks. ASD's guidance is to "treat access to advanced AI services as a security-sensitive asset."

Why a small business should care

You may not run a large AI deployment, but you probably have staff using chat assistants, writing tools or automation platforms. Each account is a login someone can steal, and many have a payment method attached. Stolen access can mean a surprise bill, exposed data pasted into conversations, or an attacker using your account for their own purposes.

A five-step checklist

1. Know which AI accounts exist and who owns each one. Ask around, because staff often sign up on their own.

2. Use phishing-resistant multi-factor authentication. See our MFA guide.

3. Keep API keys out of documents, emails and code. Store them in a password manager or a proper secrets tool. Our post on password managers is a good start.

4. Set spending limits that actually stop usage. An alert is not the same as a cap.

5. Remove access promptly when staff leave. Add AI accounts to your offboarding checklist.

Do it once, then keep it current

Run the checklist this week, then review it every quarter. AI tools change quickly and staff will keep adding new ones.

For the wider context, including AI agents that exploit weaknesses on their own, read AI is now part of your attack surface: how to use it safely. Account protection also underpins the Essential Eight, and we are happy to audit your AI accounts with you.