If your business uses AI through an API, a key to that account exists somewhere: in a config file, a mobile app, a developer's laptop, or a reseller's dashboard. On 10 September 2026 Anthropic published its fourth threat intelligence report, and its most useful sentence is not about zero-days or nation states. It is this: access to AI "in the form of compromised API keys, session tokens, and devices has increasingly become the sole objective of multiple criminal groups." Your AI key is no longer something an attacker picks up on the way to the real prize. It is the prize. This article explains why, where keys are actually leaking from, and the checklist that closes most of the holes in a week.
What Anthropic Actually Published on 10 September
The report, titled "Detecting and countering misuse of AI: September 2026", covers activity Anthropic says it disrupted between December 2025 and August 2026 across seven areas, from cyber operations to illicit distillation. These are Anthropic's own findings about misuse of its own service, so treat every figure below as "Anthropic says"; nothing has been independently audited. The report is also explicit that in every case the keys were "stolen from Anthropic customers' environments", not from Anthropic itself.
That last point is why the report matters to you rather than to Anthropic. The weak link was never the vendor. It was the customer's laptop, app, container, and decision to buy through a middleman: ordinary business mistakes, scaled up by AI.
Three Things a Thief Gets From One Stolen Key
Anthropic's framing explains why AI credentials trade differently from other leaked secrets. An operator who gets one gains three things at once:
- Loot. "Stolen keys and accounts have resale value in established markets." Brokers buy them and feed them into what the report calls fraudulent reseller networks, which "rotate in new stolen API keys and session tokens until they exhaust their usage."
- Compute. "Their attack workloads can run at someone else's expense." One affiliate of the ShinyHunters crew, after stealing a victim's AI keys during an intrusion, "switched their own attack workloads onto the victim's keys." A separate hacktivist campaign "ran for a month entirely on stolen API keys."
- Cover. "The activity is attributed to the credential's legitimate owner." A French-speaking hacktivist built a scanner that validated exposed keys and then rotated traffic across them through a local proxy, so the attacks blended in with the real owner's usage.
The durations are the part to sit with. Anthropic says one key stolen from a target's enterprise software vendor "was then used by the attacker for roughly three weeks to conduct secondary attacks", including the compromise of a French retail chain. Another actor, after prompt-injecting an AI vendor's evaluation sandbox into handing over its production keys, ran a follow-on campaign that "attacked roughly thirty AI companies in about four days." Whatever your monthly AI budget is, imagine it spent by someone else, on attacks, in your name, before the invoice arrives.
A stolen AI key is not a leaked password. It is a prepaid attack budget with your company's name on the invoice.
The "Cheap Claude" Reseller Is the Trap, Not the Bargain
This section is for every business owner in Pakistan, the Gulf or anywhere else where paying a US AI vendor by card is awkward and a Telegram channel offers frontier-model access at a discount. Anthropic documents a group it tracks as GTG-50021, a Russian- and Ukrainian-speaking crew running "a fraudulent AI reseller operation offering cheap Claude access—which turned out to be neither cheap nor actually Claude." In Anthropic's words: "Customers believed they were buying discounted Claude access, but their traffic was in fact silently proxied to a different AI model while the reseller's tooling installed a credential harvester."
A second scheme pushed visitors to discount sites to install a client application "often spoofing as popular AI harnesses including Claude Code." The installer was a credential harvester that swept every session token and API key on the device and kept reporting new ones after the victim reset the old ones. The pitch against what the report says happened:
| What the reseller tells you | What Anthropic documented |
|---|---|
| "Frontier model at a discount" | Traffic "silently proxied to a different AI model"; you pay for one model and get another |
| "Just install our client" | The client was a credential harvester that took every AI session token and API key on the device |
| "Your data stays private" | Some proxy networks "save exchanges in order to sell them to other labs"; SenseTime's distillation pipeline included transcripts bought from third-party vendors |
| "Reset your key if worried" | The harvester "continued to identify any new sessions on the device and sent them to the actor" |
| "We serve regions the vendor won't" | Anthropic: these networks "both provide Claude access to users in unsupported regions, and also save exchanges" |
Read that third row twice if you have ever pasted a customer list, a contract or a set of accounts into a chat window that reached the model through a middleman. The report says some resellers "save exchanges between users and US models without the knowledge or consent of those users" and sell them on. The discount is paid for with your conversations. Anthropic's recommendation is blunt: "AI access should be purchased only through authorized channels. An alleged discount that requires routing traffic and credentials through an unknown intermediary introduces tremendous risk to user data and systems." We agree, and the same applies to any "unlimited AI" tool that cannot say where the model actually runs.
Where Your Keys Are Leaking From Right Now
The list of sources is not exotic. Anthropic says fraudulent resellers are most commonly supplied by "legitimate customers who have inadvertently exposed their API keys and session tokens in their products, applications and public code such as GitHub, mobile application install files, Docker containers, websites, and chatbots." Every one of those is something a small software team ships without thinking:
- Mobile apps. One operator ran a pipeline across ten cloud servers that "mass-downloaded 1.8 million distinct Android APKs", decompiled them and scanned for hardcoded secrets with TruffleHog, routing verified hits to a Telegram group sorted into "over 100 source types". If your app talks to an AI provider directly with a key baked into the binary, it is already in someone's spreadsheet.
- Code repositories. A parallel "GitHub organization email harvester fed a second stream of stolen GitHub Personal Access Tokens." Anthropic says these two pipelines "supplied the initial-access credentials for the bulk of the confirmed breaches" tied to that operator.
- Containers and wrappers. Multiple actors compromised AI wrapper services' LiteLLM deployments and "used prompt injection to exfiltrate the production API keys used in their cloud-hosted container environments." If you run a proxy in front of your AI vendor, that proxy is now part of your attack surface.
- Your suppliers. In the ShinyHunters cases, "a target's AI API keys were stolen from the target's enterprise software vendors." One SaaS breach exposed "roughly 200" downstream customers and "over 2,100 Azure AD token sets spanning more than 40 corporate tenants in about 34 hours".
- Developer laptops. The spoofed-installer scheme targeted "any AI related session tokens or API keys on the victim's device", so coding-tool sessions count too.
Anthropic's conclusion is the sentence to pin above the desk of whoever manages your infrastructure: "Organizations should treat AI keys and agent integrations with the same level of seriousness as they do production credentials—because attackers treat them with the same level of seriousness, too."
This Is Not a Big-Company Problem
The Anthropic cases skew towards airlines, energy firms and ministries, which makes it tempting to file the report under "not us". A second report, published the same week by the threat intelligence firm GreyNoise, removes that comfort. GreyNoise says an attacker used "hundreds of AI Agents" built on OpenAI's Codex and a DeepSeek model to exploit two vulnerabilities in PaperCut, a print-management server that sits in schools, shops and hotels, beginning on 31 August 2026. The campaign compromised 440 PaperCut instances at 395 organisations in 48 countries. The victims were not banks. Education was the largest sector by far at 204 of the 440, with retail, professional services, real estate and hospitality making up most of the rest that GreyNoise could classify. The agents went from an empty workspace to working remote code execution in "just under four hours", and one US high school went from first access to domain administrator in seven minutes.
Two GreyNoise details matter here. The attacker kept a list of 28 countries to avoid and the agents ignored it in some cases; GreyNoise calls this "agents gone wild". And the fix was boring. GreyNoise writes that "fundamental hardening of environments still matters against AI-enabled threats", and records that one Cloudflare web application firewall "defeated the adversary" on a server the agents had marked as vulnerable. We made the same point when AI started finding zero-days on its own: the speed of the attacker has changed, and the patch window you can afford has shrunk to match.
The Ten-Point Key Check to Do This Week
None of this needs a security team, just an afternoon and a list. Here is ours, in the order that removes the most risk first:
- 1. Find every key. Search your code, build pipelines, container images and app binaries for provider key prefixes. If you do not know how many keys exist, you cannot know how many are missing.
- 2. Get keys out of anything you ship. Mobile apps, browser JavaScript and desktop clients must call your own server, and your server calls the AI provider. A key inside a shipped binary is public; the 1.8 million scanned APKs are the proof.
- 3. One key per system, never one key for everything. Your chatbot, your document pipeline and your reporting job each get their own key. When one leaks, you revoke one and the others keep running.
- 4. Put a hard spend limit on every key. Most providers let you cap monthly spend from the dashboard. A stolen key with a cap is a nuisance; a stolen key with no cap is a three-week attack campaign.
- 5. Alert on the shape of usage, not just the total. Traffic at 3 a.m. from a region you do not operate in, or a model you never call, is the signal. Anthropic's hacktivist rotated traffic across stolen keys specifically to blend in with the owner's baseline, so watch for a new baseline, not just a spike.
- 6. Rotate on a schedule and on every departure. Keys should die when the developer who created them leaves, and every quarter regardless.
- 7. Treat coding-tool sessions as credentials. The spoofed "Claude Code" installer harvested session tokens, not API keys. Install AI tools only from the vendor's own domain, and log out of them on shared machines.
- 8. Audit your proxy. If you run a gateway or wrapper in front of your provider, assume prompt injection against it is being attempted and confirm that it cannot be talked into printing its own environment.
- 9. Ask your suppliers where their keys live. Anthropic's cases include keys stolen from a target's enterprise software vendors. Any SaaS tool you connect to an AI account should be able to answer, in one sentence, how it stores and scopes that credential.
- 10. Buy only from the vendor or a named, contracted partner. No Telegram resellers, no "unlimited" plans without a stated model, no client installers from a link in a chat. If the price is impossible, the model is not what you think or the payment is your data.
Our one prediction: most AI security incidents at small businesses over the next year will not involve a model doing anything clever. They will involve a key in a Git commit, a session token on a laptop, or a reseller that was never what it claimed. Those are fixable today.
What This Means If You Run AI Software From Us, and What to Do Next
Our products sit on the boundary the report describes, so here is how they are meant to be used. Our AI Chat Assistant issues per-site API keys that you can generate, label and revoke at any time, and the widget only answers on the domains you whitelist, so a key lifted from a page source cannot be used from anywhere else. AI Cam runs its detection on a device on your own premises, talks to the cloud over its own device API keys, and keeps credentials encrypted at rest. If you take the Accounts API add-on, its keys are yours to rotate, and the ten points above apply to them too.
The reading order for the rest is simple. Our agent-security piece covers what to let an AI act on; this one covers what to let it spend. If you are budgeting next year's AI usage, what AI prices do on 1 January 2027 is the other half of the spend-limit conversation. And if you are not sure where your keys are today, talk to us. Finding them takes an afternoon. Finding out someone else found them first takes much longer.
