Kiro Account Manager Reverse-Engineered: AWS and Claude

Officially launched on November 5, 2026.

Security researcher Hans Dekker has published a detailed reverse-engineering analysis of Kiro-account-manager, a malicious tool that combines fraudulent AWS account creation with unauthorized knowledge distillation from Anthropic's Claude models. The investigation reveals a sophisticated operation that exploits both cloud infrastructure and AI model vulnerabilities, marking a new category of dual-threat attacks in the enterprise AI landscape.

How Kiro-account-manager Operates

According to Dekker's technical breakdown, Kiro-account-manager automates the creation of fraudulent AWS accounts using stolen or synthetic identity credentials. The tool bypasses standard verification processes through a combination of scripted workflows and credential stuffing techniques. Once accounts are established, the malware provisions compute resources that appear legitimate to AWS monitoring systems but serve as infrastructure for the secondary attack vector.

The fraudulent accounts are optimized for minimal detection, using spending patterns that mimic legitimate enterprise usage. Dekker notes the tool includes anti-forensic features that complicate attribution and investigation, suggesting development by actors with deep knowledge of AWS security controls.

Unauthorized Claude Distillation Mechanism

The second component of Kiro-account-manager targets Anthropic's Claude models through a knowledge distillation attack. The tool systematically queries Claude APIs using the fraudulent AWS accounts, collecting input-output pairs across diverse prompting scenarios. These pairs are then used to train a smaller, unauthorized model that replicates Claude's behavior patterns without licensing or permission.

Dekker's analysis reveals the distillation process focuses on extracting Claude's reasoning capabilities and safety alignment characteristics. The approach differs from traditional model theft by targeting behavioral patterns rather than weights, making detection more challenging for API providers. This technique allows attackers to create Claude-like models that operate independently of Anthropic's infrastructure while avoiding direct model file exfiltration.

Security Implications for Cloud and AI Providers

The Kiro-account-manager incident exposes critical vulnerabilities at the intersection of cloud resource management and AI service delivery. AWS account fraud has existed for years, but coupling it with AI model distillation creates compounding damage: stolen compute resources fund intellectual property theft from AI providers who may be unaware their models are being systematically extracted.

Industry experts responding to Dekker's findings emphasize the need for enhanced API-level monitoring that detects distillation patterns rather than just volume anomalies. Current rate limiting and abuse detection systems primarily focus on usage quantity, not the systematic behavioral probing characteristic of distillation attacks. Anthropic and similar providers may need to implement new telemetry that identifies when API access patterns indicate model extraction attempts.

• Fraudulent AWS accounts created with automated credential exploitation
• Knowledge distillation extracts Claude model behavior through API queries
• Anti-forensic features complicate attribution and investigation
• Dual-threat nature compounds damage across cloud and AI infrastructure

Release Date and Discovery Timeline

Hans Dekker officially released his reverse-engineering analysis on November 5, 2026, following several weeks of investigation after initially discovering suspicious network traffic patterns. The researcher coordinated disclosure with both AWS and Anthropic before publishing, allowing both organizations to implement preliminary detection measures. Dekker's report includes code samples and infrastructure indicators to help security teams identify Kiro-account-manager deployments in their environments.

What This Means

The Kiro-account-manager case demonstrates how attackers are evolving tactics to exploit multiple high-value targets simultaneously, using proceeds from one attack vector to fund another. Organizations using cloud AI services must now defend against threats that span infrastructure fraud, API abuse, and intellectual property theft in a single coordinated operation. The incident will likely accelerate development of integrated security frameworks that treat cloud resource management and AI model protection as interconnected challenges rather than separate domains. For enterprises building on Claude and similar models, this highlights the importance of monitoring for unusual API patterns that could indicate distillation attempts, even when usage stays within purchased rate limits.