GuardDuty AI Protection Detects Cost Harvesting, Prompt Inje

Amazon Web Services has released a dedicated threat detection module called GuardDuty AI Protection, now generally available as of mid-July, that monitors Amazon Bedrock and SageMaker AI workloads for anomalies, cost harvesting attacks, and prompt injection attempts. The capability extends the company's existing GuardDuty threat detection service into the generative AI stack, giving security teams purpose-built tooling for a category of risk that has grown alongside enterprise AI adoption.

The feature works by analyzing CloudTrail management and data events across Bedrock, Bedrock AgentCore, and SageMaker, identifying suspicious activity such as unusual invocation patterns, excessive GPU and token consumption that signals credential abuse, and prompt injection attempts that are flagged through integration with Amazon Bedrock Guardrails. Threat findings are routed directly into AWS Security Hub, providing a single pane of glass alongside existing GuardDuty detections. Once enabled, GuardDuty automatically creates a CloudTrail service-linked channel to stream the relevant data, removing the need for manual pipeline setup.

For organizations that have deployed generative AI on AWS, the service targets a growing operational risk: security teams often lack visibility into AI-specific threats because existing cloud security tools are not built to understand model invocation patterns, token economies, or prompt-level attacks. GuardDuty AI Protection addresses this by applying threat detection models designed specifically for the AI inference plane rather than general-purpose compute. The foundational GuardDuty service already monitors CloudTrail management events for suspicious activity in AI workloads, such as the unusual removal of Bedrock security guardrails, and the new AI Protection layer adds data-event depth on top of that baseline.

GuardDuty AI Protection and the Cost Harvesting Threat

One of the more tangible risks GuardDuty AI Protection targets is cost harvesting, a technique where attackers use stolen credentials to run inference on a victim's account. Because generative AI workloads are compute-intensive, a compromised API key can generate substantial GPU and token charges in a short period. AWS has highlighted this pattern as a distinct AI-specific threat that differs from traditional resource hijacking, given the rate at which inference costs accumulate compared to conventional compute. A single compromised Bedrock endpoint running a large language model can consume thousands of dollars in inference credits before a team notices unusual billing patterns.

The protection layer requires no custom tooling or manual rule configuration. Customers enable it through the GuardDuty or Security Hub console. Organizations using AWS Organizations can roll out the feature centrally across accounts. A 30-day free trial is available for existing GuardDuty customers.

Broader Security Expansion

GuardDuty AI Protection is one of three security launches AWS has put out this summer. Alongside the AI threat detection module, the company has released GuardDuty AI-powered investigations in preview across 10 AWS regions, a feature that automates the triage of GuardDuty findings by analyzing context and related account activity to distinguish real threats from benign noise. The investigations system uses knowledge graphs and threat intelligence to correlate activity across findings, an approach that directly targets the alert fatigue problem that slows incident response in security operations centers.

AWS has also made Security Hub AI inventory generally available, offering a continuously updated view of AI assets, models, agents, and pipelines across the organization. This inventory gives security teams a single source of truth for what AI resources exist in their AWS accounts, addressing a visibility gap that often leaves shadow AI deployments unmonitored.

The timing of these releases reflects a broader market reality. As enterprises move generative AI applications from experimental pilots into production, the attack surface expands accordingly. The company has positioned these capabilities as a way to close that visibility gap without requiring teams to build detection logic from scratch.

Multi-Cloud and Competitive Positioning

The AI Protection module fits into a broader AWS strategy to become a multi-cloud security control plane. For the first time, AWS Security Hub has extended monitoring to Microsoft Azure, discovering Azure virtual machines, container images, Function Apps, and identities. These Azure assessments follow the CIS Microsoft Azure Foundations Benchmark, giving organizations a standardized evaluation framework across clouds. This multi-cloud expansion positions Security Hub as a competing offering against dedicated cloud security posture management tools from vendors like Wiz, CrowdStrike, and Palo Alto Networks.

For security decision-makers, the availability of GuardDuty AI Protection eliminates a blind spot that has become more pressing as AI-related cloud spend grows. The cost harvesting detection alone addresses a pain point that is difficult to mitigate with traditional cloud security tools, which are not designed to understand the cost profile of a model invocation or the billing implications of a compromised Bedrock API endpoint. A detection gap that previously required custom CloudTrail analysis and anomaly threshold tuning is now available as a toggle in the console.

The feature integrates deeply with the broader AWS security ecosystem. Findings from GuardDuty AI Protection feed into AWS Security Hub, where they can be correlated with other cloud security detections. The company has also launched an AI Security Best Practices standard within Security Hub CSPM, a set of 31 automated controls that evaluate Bedrock, Bedrock AgentCore, and SageMaker workloads against recommended configurations without manual assessments. These controls cover network isolation, encryption at rest and in transit, VPC configuration, KMS key usage, private container registry requirements, and permission management.

Detection Methodology and Data Sources

GuardDuty AI Protection analyzes two categories of CloudTrail data. Management events capture changes to AI resource configurations, such as the unusual removal of Bedrock security guardrails or modification of model access policies. Data events capture the invocation activity itself, including model inference calls, token consumption patterns, and API usage rates. By correlating both event types, the system can distinguish between a configuration drift that opens a security gap and an active attack that exploits one.

The prompt injection detection pathway works through the Bedrock Guardrails integration. When a prompt attempt is blocked by Bedrock Guardrails, that event is surfaced as a GuardDuty finding rather than remaining siloed inside the model interaction layer. This matters for organizations that need to demonstrate detection coverage for OWASP LLM Application Top 10 risks, particularly the prompt injection and sensitive information disclosure categories.

What It Means for Enterprise Security Teams

For organizations that have deployed generative AI on AWS, GuardDuty AI Protection reduces the burden of building custom detection pipelines for AI workloads. The automatic CloudTrail integration and Security Hub correlation mean that existing security operations workflows can absorb AI threat detection without architectural changes.

On the prompt injection front, the integration with Bedrock Guardrails adds a detection layer at the model interaction boundary. While Bedrock Guardrails already block certain categories of harmful prompts, GuardDuty AI Protection surfaces the attempt as a security finding, which matters for compliance and incident reporting requirements. This distinction is important for regulated industries where detection and reporting of attempted attacks is a compliance requirement, not just a security best practice.

The preview of AI-powered investigations within GuardDuty suggests that AWS is thinking about the analyst workflow as well. Rather than drowning security teams in raw findings, the system automatically correlates activity and separates real threats from benign findings. The 90-day context window used by these investigations means analysts can trace a finding back through related activity without manually stitching together CloudTrail logs.

Why This Matters

The availability of GuardDuty AI Protection signals that AI workload security has shifted from an afterthought to a product category. For enterprises running generative AI on AWS, the feature closes a gap that traditional cloud security tools were never designed to cover — the specific cost, access, and prompt-level risks of model inference. Organizations that enable it gain a detection layer that maps directly to the financial and operational exposure of their AI deployments, without adding custom instrumentation or changing their existing security workflow.