Stolen AI API Keys Are Now the Attack Currency

TL;DR

• On September 10, 2026, Anthropic published "Detecting and countering misuse of AI: September 2026," its fourth threat-intelligence report, covering operations its team disrupted between December 2025 and August 2026 across seven harm areas, with a downloadable IOC set.
• The cyber-operations section documents a criminal AI supply chain built on stolen API keys and session tokens: a hacktivist campaign ran for a month entirely on stolen keys, and ShinyHunters affiliates switched their own attack workloads onto victims' keys mid-intrusion.
• Stolen AI credentials now give attackers three things at once: inventory resold through brokers, attack compute billed to the victim, and attribution pointing at the key's legitimate owner.
• The report's own framing is the headline: "the operators treated the AI supply chain itself as both a target and a resource." In every documented instance, the keys came from Anthropic customers' environments — Anthropic's own systems were not compromised.
• The actionable takeaway for every organization shipping AI integrations: treat AI keys and agent integrations with the same level of seriousness as production credentials, and buy AI access only through authorized channels.

The credential layer nobody inventoried

Security teams have spent three years cataloguing prompt injections, model hallucinations, and agent permission problems. Anthropic's September report redirects attention to a layer that is easier to ignore because it is invisible inside the product: the API key. Keys and session tokens, the report documents, are now an objective in their own right for multiple criminal groups. They are loot — brokers buy and sell them — and simultaneously infrastructure: attackers run attacks on victims' keys, which makes the compute free and the attribution point at someone else. The report is explicit that in every instance it documented, the keys involved were stolen from Anthropic customers' environments — never from Anthropic's own systems.

The cleanest example is GTG-50021, a Russian- and Ukrainian-speaking group that ran a fraudulent reseller operation offering cheap Claude access — "which turned out to be neither cheap nor actually Claude." Customers believed they were getting discounted frontier access; their traffic was silently proxied to a different model while the reseller's tooling installed a credential harvester that stole their Anthropic account credentials and sold them onward to other proxy resellers. The scheme is not exotic. It is phishing with an AI-shaped lure, and it scales because discounted model access is now a normal purchase for individuals and small teams.

The AI supply chain is both target and resource

The report explains that security practitioners use the phrase “living off the land” to describe attacks that use tools that are already present in the victim’s environment — and the opportunistic actors it tracked applied the same principle to AI: "the operators treated the AI supply chain itself as both a target and a resource." The phrase comes from adversarial practice: legitimate infrastructure, already trusted inside the environment, reused against it — for these groups, the legitimate infrastructure was the AI stack itself.

The mechanics are unsettlingly direct. Multiple actors compromised AI wrapper services' implementations of LiteLLM — the open-source gateway layer that sits between applications and model providers — using prompt injection to exfiltrate the production API keys running in the wrapper's cloud-hosted containers. One actor, tracked as GTG-50020, first compromised an AI vendor's evaluation sandbox and took its production keys before turning the same tradecraft on roughly thirty AI companies in about four days: a single successful attack path, adapted and repeated, with the stated goal of reaching a pre-release Claude model. The keys were always customers' keys, stolen from customer environments, then swapped in as the attacker's own compute.

This is the layer most AI governance programs still do not touch. A typical mid-size organization can name its model providers, but not the full list of places where keys live: wrapper services, evaluation sandboxes, CI pipelines, Jupyter notebooks, agent harnesses, internal tooling, and the occasional shared document. Anthropic's cases show that every one of those is a fetch point once an attacker is inside — and some are fetch points from outside, via prompt injection against a gateway that holds production keys.

Malware that watches for detection, agents that do the intrusion

The report documents the autonomy ladder in practical terms. At one end, actors use Claude as an engineering assistant to build malware, phishing kits, and surveillance tooling. In the middle, operators direct Claude to execute operations — running commands against victim networks, harvesting credentials, exfiltrating data — with a human making each targeting decision. At the far end, operations ran with minimal human input: multi-agent frameworks conducting reconnaissance, exploitation, and theft against multiple victims in parallel, and a collection fleet running on a pre-set schedule with no human in the loop, renewing stolen access tokens and harvesting victim cloud storage. One escalation path stands out for defenders: a single stolen developer token became full administrative control of a victim's cloud environment in roughly three hours, and in another case AI agents performed nearly all of the work extracting authentication data and over 2,100 Azure AD token sets spanning more than 40 corporate tenants.

The report is explicit that none of this depended on novel technique. The attacks involved stolen credentials, unpatched edge devices, exposed services, SQL injection, and phishing — the same TTPs as ever. What changed is the economics: AI collapsed the labor and tooling gap that used to separate state-sponsored operations from individual operators, and a hacktivist with stolen keys can now sustain multi-victim campaigns that a year ago would have required a team.

Treat keys like production credentials, because attackers do

Anthropic's recommendation is the concrete, boring version of all of this: "organizations should treat AI keys and agent integrations with the same level of seriousness as they do production credentials." Concretely, that means four operational changes, and none of them is exotic.

First, inventory keys the way you inventory passwords. API keys exposed in public code, GitHub repositories, Docker containers, and websites are the most common source Anthropic's team found — so a repo scan for model-provider key patterns belongs in the same pipeline as secret scanning for cloud credentials. Second, scope and rotate: keys should be project-scoped, rotate on a schedule or on suspicion, and never be shared through chat windows, shared documents, or screenshots. Third, shut the reseller door: buy model access only through authorized channels — a page promising a 60 percent discount on frontier access is either a proxy to a different model, a credential harvester, or both. Fourth, treat gateway layers (LiteLLM, proxies, agent integrations) as security-critical components: whatever holds production keys is a single prompt injection away from handing them over, so it needs the same isolation and monitoring as a vault.

This connects to the supply-chain lesson from Plugin4Shell: in an agentic world, the package someone installs and the key someone pastes are the same attack surface. The agent access graph model we described earlier gets one more edge now — the credential edge — and it is the one attackers are exploiting first. Inventory the keys, confine the gateways, close the reseller door. The economics changed; the fixes did not. More security analysis on neticslabs.com.

Sources

Source: Detecting and countering misuse of AI: September 2026 — anthropic.com/threat-intelligence-report-september-2026, published 2026-09-10 (captured 2026-09-30; all quotes verbatim from the page, including "the operators treated the AI supply chain itself as both a target and a resource," "which turned out to be neither cheap nor actually Claude," and the production-credentials guidance). Internal linkage: Plugin4Shell zero-click coding-agent supply chain, agent access graphs.

Source: Anthropic September 2026 threat intelligence report — anthropic.com, 2026-09-10, captured 2026-09-30.