Meet the newest AI security threat: token torching

Malicious actors may really start to hit companies where it hurts: by draining their AI tokens.

Cybersecurity company Bitsight unearthed a potential threat to AI-enabled companies. The cyberattack, dubbed “token torching,” involves malicious actors using malicious prompts to exhaust a company’s AI tokens.

How it works. As Bitsight detailed in a July 8 blog post, a token torching attack can occur in three different ways:

• Contradiction injection: When a threat actor puts contradicting instructions in a prompt, which causes the AI system to waste time trying to reason through the conflicting information.
• Decoy injection: When the attacker hides superfluous instructions or a complex puzzle in materials that AI systems consume, causing a larger output than expected.
• Prompt manipulation: When prompts are designed to trigger lengthy or repetitive responses.

Token torching differs from traditional cyberattacks in that there’s no need to exploit a vulnerability or bypass authentication to perform it. And as Bitsight Threat Intelligence Researcher Emma Stevens added, the incentive behind it is also slightly different.

“It can be to limit a company’s resources, to just be a general nuisance,” Stevens said, adding malicious actors may engage in token torching to stage a distraction from more nefarious activity.

“If your SOC team is busy triaging tokens that are mysteriously running out all of a sudden, then they have less time to focus on maybe an MFA bypassing or a credential-stealing operation going on in the background,” Stevens said.

Token torching on the rise. Stevens believes token torching will evolve into a large threat for businesses as more implement AI into their workflows. While Bitsight has not seen a confirmed case of token torching in the wild yet, Stevens noted there has been a lot of “chatter” around the topic in the past year.

“I saw 275 deep and dark web results for threat actors either claiming to have done token torching…or talking about how to do token torching or what they would use it for,” Stevens said, adding she did not see any proof behind these claims.

How to protect your company. In its blog post, Bitsight said token torching could be hard to detect because requests to AI systems may look harmless.

Stevens said organizations can protect themselves from token torching by setting rate limits on the number of requests a user can send within a given timeframe: “Those rate limits do prevent [malicious actors] from sending hundreds of questions within an hour-long period.”

She added teams should be mindful of any large spikes in usage by users: “If you see a user who typically uses their AI platform three to five times a day is now using it 75 times in an hour, probably something you want to look into.”