What an attacker can reach once an AI system holds credentials, and the controls that contain it.
A sandbox that contains the process but not the credential contains nothing. The September 2026 threat report shows keys taken from a vendor sandbox.
Anthropic's September 2026 report shows stolen AI keys funding attacks and a fake reseller harvesting them. The controls for these keys lag a decade.
Prompt injection defences fail sometimes. Scope decides what happens then. Four permission questions that bound the damage when the model is convinced.
Top of the OWASP list since 2025, and used against a vendor sandbox in the September 2026 threat report. Four control classes, honestly rated.