Anthropic report details how stolen AI API keys became currency for cyberattacks

Anthropic's fourth threat-intelligence report, published on September 10, 2026, documents a criminal economy built on stolen AI credentials. According to the report, which a write-up on dev.to summarizes, API keys and session tokens taken from customer environments are now resold through brokers, used to bill attack compute to the victims they were stolen from, and used to make malicious activity look like it belongs to the key's legitimate owner.

The report, titled "Detecting and countering misuse of AI: September 2026," covers operations Anthropic says it disrupted between December 2025 and August 2026 across seven harm areas, and ships with a downloadable set of indicators of compromise. Its framing of the credential problem is blunt: in the report's words, "the operators treated the AI supply chain itself as both a target and a resource."

Keys as loot and as infrastructure

The cyber-operations section shows that a stolen AI credential hands an attacker three things at once. It is inventory, which brokers buy and resell. It is compute, because attacks run on the victim's billing. And it is cover, because activity on a stolen key points investigators at whoever legitimately holds it.

Two cases anchor the finding. A hacktivist campaign reportedly ran for a full month entirely on stolen keys, and affiliates of the ShinyHunters group moved their own attack workloads onto victims' keys partway through intrusions. Anthropic stresses that in every documented case the keys came from its customers' environments — the company's own systems were never compromised.

Reseller scams and compromised gateways

One tracked group, labeled GTG-50021 and described as Russian- and Ukrainian-speaking, ran a fraudulent reseller offering discounted Claude access — access the report says was "neither cheap nor actually Claude." Customers' traffic was quietly proxied to a different model while the reseller's tooling harvested their Anthropic account credentials and passed them on to other proxy resellers.

Elsewhere, multiple actors compromised AI wrapper services running LiteLLM, the open-source gateway that sits between applications and model providers, using prompt injection to extract production API keys from cloud-hosted containers. A group tracked as GTG-50020 first breached an AI vendor's evaluation sandbox and took its production keys, then reused the same approach against roughly thirty AI companies in about four days, with the stated goal of reaching a pre-release Claude model.

Agents doing the intrusion

The report also sketches an autonomy ladder. At the low end, actors used Claude as an engineering assistant to build malware, phishing kits and surveillance tooling. In the middle, operators directed the model to run commands against victim networks, harvest credentials and exfiltrate data, with a human making each targeting decision. At the far end, operations ran with minimal human input: multi-agent frameworks performed reconnaissance, exploitation and theft against multiple victims in parallel, and one collection fleet operated on a preset schedule with nobody in the loop, renewing stolen tokens and draining victims' cloud storage.

The escalations are steep. In one case, a single stolen developer token became full administrative control of a victim's cloud environment in roughly three hours. In another, AI agents did nearly all the work of extracting authentication data and more than 2,100 Azure AD token sets spanning more than 40 corporate tenants. A ShinyHunters-aligned pipeline tracked as GTG-50014 scanned Android APKs for hardcoded secrets and routed verified finds in real time.

None of this required novel techniques. The report lists stolen credentials, unpatched edge devices, exposed services, SQL injection and phishing as the underlying methods. What changed is the economics: AI collapsed the labor and tooling gap that once separated state-sponsored teams from individual operators, letting a hacktivist with stolen keys sustain campaigns that a year earlier would have required a team.

What Anthropic recommends

The report's advice is deliberately unglamorous: treat AI keys and agent integrations with the same seriousness as production credentials. The most common source of exposed keys Anthropic's team found was public code — keys pasted into GitHub repositories, Docker containers and websites. The dev.to write-up adds that keys tend to live in more places than governance programs track, including wrapper services, evaluation sandboxes, CI pipelines, notebooks, agent harnesses and shared documents, and it advises buying AI access only through authorized channels.

Why it matters

For developers, this lands squarely on your desk. The credential layer beneath AI products — the key in the .env file, the gateway holding production keys, the evaluation sandbox nobody audited — is now a primary attack objective in its own right, and prompt injection against a key-holding gateway means some of those fetch points are reachable from outside. The stakes are doubled: a stolen key means someone else's attacks running on your bill, in your name. As the ShinyHunters cases show, attackers already treat the AI stack as infrastructure to live off, so any organization shipping AI integrations needs to inventory where its keys live before someone else does.