A man in Shanghai has been sentenced to three years in prison, suspended for three years, and fined 40,000 yuan for illegally obtaining computer system data. The case, dubbed “AI vs. AI,” saw the individual, identified as Zong, exploit AI platforms to steal computing power and sell services.
Cracking the Code with AI
According to a report by Shanghai Legal News on November 2nd, Zong, possessing a technical background, learned how to access AI platform APIs and decided to exploit this knowledge. He targeted an AI model aggregation platform operated by an artificial intelligence company. This platform allows users to generate images and videos by consuming credits, for which the company pays upstream model providers for computing power costs.
Zong bypassed the platform’s unofficial API interfaces and set up his own “transit website.” Through this site, he offered AI-generated art and video services at low prices. Crucially, while the website appeared to be his, the backend was secretly using the AI model aggregation platform’s paid computing power – essentially siphoning off and reselling another company’s resources.
A Sophisticated Attack
The platform implemented several security upgrades over time, but Zong managed to circumvent each one. The company only became aware of the issue in March of this year when abnormal data was detected in their backend systems, leading to Zong’s arrest. By then, he had made over 290,000 unauthorized API calls and illegally profited more than 34,000 yuan by reselling the generated services.
Zong’s method was a sophisticated “AI versus AI” battle. Initially, he used AI to write automated registration scripts. He then purchased a large number of email accounts to create a pool of nearly 300,000 free accounts, which he rotated to make API calls. When the platform introduced IP registration restrictions, he employed AI tools to bypass these new measures.
Bypassing Advanced Security
In January of this year, the platform upgraded its security again, adding an electronic signature verification mechanism. However, this also failed to stop Zong. He utilized AI tools to create automated scripts that forged electronic signatures, allowing him to continuously bypass the verification and initiate calls. The company’s defenses – including member accounts, registered emails, IP addresses, and electronic signatures – were systematically breached.
Earlier this year, the victimized company discovered an alarming anomaly: two of their video and graphic design applications suddenly saw an influx of over 4 million users registered from the same IP address within a short period. This massive surge in registrations, all linked to a single IP, was a key indicator of Zong’s large-scale fraudulent activity.
Legal Ramifications
Following the company’s report, Zong was apprehended. The Xuhui District Procuratorate brought charges against him for illegally obtaining computer system data. The Xuhui District Court recently handed down the sentence, highlighting the severity of exploiting AI technologies for illicit gains.
This case serves as a stark reminder of the evolving landscape of cybercrime, where AI tools are increasingly being used by malicious actors to bypass sophisticated security measures. The ability to automate complex attacks and circumvent multiple layers of defense underscores the need for continuous innovation in cybersecurity strategies.
