Use Case: Model Theft | Detection.FYI

GCP Vertex AI High GenerateContent Volume From Single IP

Oct 7, 2026 · Domain: GenAI Domain: Cloud Data Source: GCP Vertex AI Data Source: GCP Data Source: Google Cloud Platform Platform: GCP Service: GCP Vertex AI Use Case: Model Theft Use Case: Threat Detection Tactic: Collection Threat: LLMjacking Threat: Unauthorized AI Usage Mitre Atlas: AML.T0024 Mitre Atlas: AML.T0024.002 Mitre Atlas: AML.T0029 Resources: Investigation Guide Rule Type: ES|QL ·
Share on:

Detects a single source IP making a high number of Vertex AI GenerateContent (or StreamGenerateContent) audit calls against the same model resource in the lookback window. That pattern fits model extraction, automated scraping, or a compromised caller burning prediction quota.

Read More
Potential Azure OpenAI Model Theft

Oct 7, 2026 · Domain: GenAI Data Source: Azure OpenAI Data Source: Azure Event Hubs Use Case: Model Theft Resources: Investigation Guide Noise: Low Performance: Fast Profile: Recommended Threat: Unauthorized AI Usage Threat: LLMjacking Rule Type: ES|QL Platform: Azure Domain: Cloud Service: Azure OpenAI Service: Azure Event Hubs Mitre Atlas: AML.T0044 Mitre Atlas: AML.T0024.002 ·
Share on:

Monitors for suspicious activities that may indicate theft or unauthorized duplication of machine learning (ML) models, such as unauthorized API calls, atypical access patterns, or large data transfers that are unusual during model interactions.

Read More