What an attacker can reach once an AI system holds credentials, and the controls that contain it.
Anthropic's September 2026 report shows stolen AI keys funding attacks and a fake reseller harvesting them. The controls for these keys lag a decade.
Prompt injection defences fail sometimes. Scope decides what happens then. Four permission questions that bound the damage when the model is convinced.
Top of the OWASP list since 2025, and used against a vendor sandbox in the September 2026 threat report. Four control classes, honestly rated.