Google Found Illicit Model Access at 97% Off

In 2026, Google Threat Intelligence Group found dark-web sellers offering access to Google, OpenAI, and Anthropic models at discounts of up to 97%. Inside the illicit market, the three rival labs became interchangeable. A working credential let its holder spend scarce inference until the account was revoked.

Anthropic’s 2024 release of the Model Context Protocol connected assistants to data sources. By 2026, Google had attached AI agents to phone calls, home devices, and enterprise services, while OpenAI had introduced an agent-management product with permission boundaries. These systems moved from answering prompts to delegating actions across systems. Every added action required someone to issue, monitor, and withdraw another permission.

A stolen login turns inference into a bearer asset

Security researchers also warned that “LLM-jacking” attacks against companies’ costly AI resources were increasing.

A working credential lets the seller resell inference without owning a model or renting a GPU. The credential confers spending authority until the provider, customer, or intermediary detects the misuse and closes it. That structure turns a subscription, API key, or service account into a temporary bearer asset.

The discount reveals more than theft. Dark-web sellers can place competing model services in the same storefront because compromised access makes provider differentiation secondary to available entitlement. A buyer seeking cheap inference can accept whichever account still works because the compromised credential has already paid the integration cost.

This is AI access arbitrage: the legitimate customer acquires access at the provider’s terms, an attacker transfers the practical benefit, and the illicit market clears at a price divorced from the published tariff. Google Threat Intelligence Group did not establish whether the provider or customer ultimately absorbs each unauthorized charge. The group did establish that the reseller can capture value while pushing detection, investigation, and remediation costs elsewhere.

Dark-web sellers already connect Google, OpenAI, and Anthropic in one confirmed illicit-access market. The companies have yet to confirm two reported connections through related safety standards. Criminal sellers have achieved practical interoperability before the providers have established a confirmed common control regime. A related Hugging Face access-control incident showed the same underlying problem at a model hub, where the authority attached to an account mattered as much as the stored software.

Google is delegating authority faster than sign-in can describe it

Google’s exposure now extends beyond Gemini API consumption. The company is testing Call for Me, which allows Gemini to telephone businesses on a user’s behalf. Google initially limited the test to US Pixel 11 users with a Gemini subscription. The agent retrieves information while representing the user to another party.

Google Home moves the delegation into a physical environment. Its MCP integration lets third-party agents analyze home data, control devices, and build dashboards for Premium Advanced users in the US. Google also announced a Gemini Enterprise Agent Platform on Vertex AI to manage the lifecycle of agent fleets.

Those products create different principals with different authority. A person owns the account. An agent acts under delegated instructions. A device exposes state and accepts commands. A third-party service supplies context or executes a task. Google must preserve the chain among them when a request crosses product boundaries; authenticating the human at the beginning does not specify what every downstream machine may do.

The available Google Home reporting does not document the exact credential scope, which agents can control which devices, whether approval attaches to each action or persists across sessions, or how quickly users can revoke access. It also does not establish the audit, attestation, confirmation, incident-response, or liability rules for a mistaken action. Google may have such controls, but the public evidence cannot yet support a judgment about their maturity.

Call for Me poses a narrower version of the same design problem. Google has to distinguish the user’s intent from the agent’s implementation, then constrain the agent to the requested business call. An account-level permission such as “use Gemini” says too little once Gemini can represent the user, obtain information, and interact with outside services.

Scarce GPUs increase the blast radius of a bad credential

Epoch AI estimated that Google controls roughly 25% of global AI compute, including about 3.8 million TPUs and 1.3 million GPUs. OpenAI said it had contracted for 10GW of US AI compute capacity and added more than 3GW during the previous 90 days. Under its AWS agreement, OpenAI said it would use hundreds of thousands of Nvidia GPUs in the US.

Other buyers are making similarly concrete commitments at smaller scale. Recursive Superintelligence signed a multiyear AWS compute agreement worth $410 million after raising $650 million in May. Those contracts allocate capacity to named customers, but they cannot determine whether every accepted request comes from the intended person, application, or agent.

Smaller AI startups have struggled to obtain Nvidia GPUs as large cloud providers direct supply toward internal teams and major customers. OpenAI’s capacity agreements and those shortages rule out the easy conclusion that identity has displaced hardware, model quality, distribution, proprietary data, or cloud economics as a moat.

When compute is scarce, a stolen credential can expose reserved capacity that another company spent heavily to secure. The physical supply chain may place a GPU in the correct data center and assign it to the correct commercial account while the logical request still comes from the wrong actor.

Compromised entitlements make compute chain of custody an identity problem. Chipmakers establish hardware provenance. Clouds allocate machines. Model providers meter inference. Customers delegate access to applications and agents. Each participant can complete its own step correctly while a compromised entitlement corrupts the final allocation. The frontier-lab financing loop can secure more capacity without securing the right to consume it.

Agent permissions must expire at task speed

The Agentic AI Foundation’s July update to MCP introduced a fully stateless architecture, a hardened authentication model, and a formal 12-month deprecation policy. Protocol maintainers made authentication a core architectural concern because an agent connection can combine context retrieval with tool execution. An authentication decision can consequently authorize more than reading data.

Researchers examining GitHub’s official MCP server found that attackers could trick an LLM agent into leaking private information about the MCP user. The agent retained legitimate access; the attacker redirected how it used that access. Authenticating the agent did not guarantee that its behavior remained aligned with the user’s intended task.

A production control plane must give each machine actor a distinct identity, bind it to a named principal, limit resources and actions to a particular task, impose time and spending limits, record behavior, and propagate revocation across every connected model and tool. A provider that revokes only the human session leaves little comfort if a delegated token continues working elsewhere.

Builders are already assembling pieces of that layer. OpenAI’s Frontier offers shared context, onboarding, and permission boundaries to a limited set of customers. Google’s enterprise platform manages agent fleets across their lifecycle. Oak emerged from stealth with a $60 million seed round to build AI-native identity and access management. No one needed to coordinate these products. Agents carrying authority across systems made the same control problem rational for each builder to address.

Operators must monitor agent systems differently. A model’s evaluation score measures capability under test conditions. An authorization system must evaluate conduct during deployment: which agent invoked which tool, under whose grant, against which resource, and whether that sequence still matches the approved task. Operators must know both whether the model can act and whether it still may.

The valuable control plane earns trust by saying no

Okta reported fiscal second-quarter revenue of $805 million, up 11% year over year, and net income of $116 million, up 73%. The company also cited growing demand for AI identity security. Okta later agreed to acquire AI identity startup Permiso in a transaction reportedly valued at just under $200 million.

Okta shows how existing categories can converge around enforcement. Model providers can meter tokens and restrict tools. Cloud platforms can connect identity to billing and capacity. Identity vendors can follow principals across multiple clouds and models. Gateways can inspect requests at the boundary. Customers need all four functions to agree on whether a particular action remains authorized.

An embedded control plane can accumulate switching costs when customers encode agent roles, approval policies, behavioral baselines, incident histories, and revocation procedures inside it. The operator also develops process advantages as each anomaly improves detection and each incident tests response. The advantage comes from serving as the trusted system of record for entitlements and risk.

Model providers still compete on quality, distribution, proprietary data, and cloud economics despite the 97% discount. Okta’s quarterly results do not establish that a standalone identity vendor will own the layer. OpenAI, Anthropic, AWS, Microsoft, and more than 100 other companies have warned of a limited window to prepare for AI-enabled cyberattacks, but their warning does not determine which participant captures the economics.

When customers can move among models and agents can cross tool boundaries, no single provider sees the entire authorization chain. The 97% discount prices that blind spot. The durable privilege belongs to the operator that can revoke a bad entitlement across models, tools, devices, and clouds before the next token, phone call, or physical action clears.