In short
- Anthropic's report covering December 2025 to August 2026 documents stolen AI API keys being used to fund further operations, and a fraudulent reseller built specifically to harvest them.
- One tracked group dumped 2,100 cloud token sets across 40 corporate tenants in 34 hours, which is the speed a credential control has to survive.
- Another maintained a standing fleet of 13 collection agents and produced 12 possible zero-day findings in a single month against roughly 50 organisations.
- The keys are harvested from the places code lives: repositories, container images, mobile app bundles and vendor sandboxes. Only one of those is covered by a typical secret scanning policy.
- Anthropic's own recommendation is the short version of this article: treat AI keys and agent integrations with the same seriousness as production credentials, and buy access only through authorised channels.
What do AI assistants say about your organisation?
Model answers are becoming a channel your communications team does not control. EntityRise audits how assistants describe your company and whose name they give instead. From $19.
An AI API key used to be a billing detail. The September 2026 threat report describes it as loot.
The report covers December 2025 to August 2026, and the pattern that runs through it is not a clever jailbreak. It is credentials.
01What did the September 2026 report actually show?
Autonomous operations at a pace that assumes nobody is reading logs in real time.
| Tracked activity | Reported scale | What it implies for defenders |
|---|---|---|
| Cloud token sets dumped by one group | 2,100 across 40 tenants in 34 hours | Detection windows measured in days are useless |
| Standing collection agents run by one group | 13 | Reconnaissance is continuous, not campaign based |
| Possible zero-day findings in one month | 12 | Vulnerability discovery is being industrialised |
| Organisations targeted by that group | ~50 | Breadth no longer costs analyst hours |
| Downstream organisations reached via one SaaS breach | ~200 | The supplier is the blast radius |
The report is careful about what remained human: target selection, monetisation, and review of results. What the automated middle can reach is a question of what the agent was authorised to do. What was automated is the middle, and the middle used to be the expensive part.
02Why is an AI key different from a SaaS login?
Because it is not access to an account. It is access to compute.
A stolen CRM password gets an attacker your customer list. A stolen AI key gets them a general purpose machine that writes code, summarises stolen data and drives the next stage of the operation, billed to you. Anthropic’s September 2026 report documents exactly this: keys stolen from target environments and used to provide additional AI compute for the same campaign.
There is a second difference that matters more for governance. Most AI keys were issued outside the process that governs credentials. They were created during an evaluation, pasted into a service, and never entered an inventory, because at the time the risk looked like an unexpected invoice.
03Where do the keys leak from?
From the four places code actually lives, and one of them is not yours.
Anthropic’s September 2026 report describes keys harvested from public repositories, from container images, from mobile application bundles, and in one case from a vendor sandbox, where an actor injected malicious instructions and obtained production keys belonging to several providers at once.
That last route breaks the usual model. The organisation whose key leaked did nothing wrong in its own environment. It handed a credential to a supplier, which is what integration means, and the supplier’s sandbox was the weak point.
A separate case describes a fraudulent reseller offering discounted access while proxying traffic to a different model and harvesting the credentials of everyone who signed up. The commercial signal there is worth stating plainly: a discount that requires routing your traffic and your credentials through an unknown intermediary is not a discount.
04What does a credential-grade control set look like?
| Control | Typical for a database password | Typical for an AI API key |
|---|---|---|
| Inventory and owner | Mandatory, in a register | Frequently absent |
| Rotation | Scheduled, often 90 days | On breach, if ever |
| Scope limitation | Least privilege by role | 1 key, full account access |
| Spend and rate anomaly alerting | Not applicable | Rarely configured |
| Revocation drill | Tested in DR exercises | Never rehearsed |
Four of those five rows are solved problems borrowed from somewhere else. The fifth, spend and rate anomaly alerting, is specific to this credential class and is also the cheapest detection available, because an attacker running inference on your key produces a billing signal before it produces a security signal.
05What should procurement stop allowing?
Three things, and none of them require new tooling.
Buying AI access outside authorised channels, which is what the fraudulent reseller case exploits. Issuing account-wide keys where the provider supports scoped or project-level ones. And accepting a supplier integration without asking where the key you hand over is stored, which is the question the vendor questionnaire should carry.
For entities in scope of NIS2, this is not only good practice. Article 21 requires supply chain security and access control policies as part of the baseline measures, and an unrotated, uninventoried credential shared with a supplier is a poor answer to both.
06Frequently asked questions
Why is a stolen AI API key worse than a stolen SaaS login?
Because it is compute rather than access to one account. A stolen key lets an attacker run inference at your expense, and increasingly to run the automation that carries out the attack itself, which turns your billing relationship into their infrastructure.
Where do AI API keys actually leak from?
Public code repositories, container images, mobile application bundles and third-party sandboxes, according to the September 2026 threat report. The vendor sandbox case is the one most organisations do not model, because the key is exfiltrated from a supplier environment rather than their own.
What is the fastest control to put in place?
An inventory. You cannot rotate, scope or revoke keys you cannot list, and in most organisations AI keys were issued outside the process that tracks database and cloud credentials because they were bought on a card as an experiment.
Does the EU AI Act say anything about this?
Indirectly. Article 15 requires high-risk systems to achieve an appropriate level of accuracy, robustness and cybersecurity, and to be resilient against attempts to exploit vulnerabilities. A key that grants unmonitored inference at your expense is squarely a cybersecurity control failure.
07References and method
- Anthropic, Countering misuse of AI: September 2026, threat intelligence report covering December 2025 to August 2026. Source for the tracked actor figures, the fraudulent reseller case, the vendor sandbox key theft and the closing recommendation on treating AI keys as production credentials.
- Figures attributed to individual tracked groups are as reported by Anthropic. We have not independently verified them and we report them as findings of the publisher, not as our own measurements.
- Regulation (EU) 2024/1689, Article 15, for the accuracy, robustness and cybersecurity requirements applying to high-risk AI systems.
- Directive (EU) 2022/2555 (NIS2), Article 21, for the supply chain security and access control measures required of essential and important entities.