The INTEL  

Your AI keys are now worth stealing for their own sake. Anthropic’s September 2026 threat report finds that access to AI (compromised API keys, session tokens and devices) “has increasingly become the sole objective of multiple criminal groups,” who sell it through brokers into fraudulent reseller networks. The report explains why: an attacker holding your AI credentials gains three things at once. Loot, because stolen keys resell in established markets. Compute, because their attack workloads run at your expense. And cover, because the activity is attributed to you.

The cases show all three. Suspected ShinyHunters affiliates who found a victim’s AI keys during an intrusion switched their own attack workloads onto them, and one stolen key was used for roughly three weeks to attack other organizations. A hacktivist campaign ran for a month entirely on stolen keys. Another actor, GTG-50020, injected malicious instructions into an AI vendor’s automated evaluation sandbox, which handed over the vendor’s production API keys from multiple AI providers.

Where do attackers get the keys? The report is direct: most commonly from legitimate customers who exposed them by accident, in products, apps, public code on GitHub, mobile app install files, Docker containers, websites and chatbots. One operator mass-downloaded 1.8 million Android apps and scanned them for hardcoded secrets.

Why It Matters  

Most organizations treat AI keys as a developer convenience, not a production credential. They sit in config files, get shared in chat, and rarely appear in a credential inventory. That gap is exactly what this market exploits.

The “cover” point is the one risk leaders should dwell on. If an attacker runs an intrusion on your key, the provider’s logs show your account attacking someone else. Beyond the bill, that’s a reputational and potentially legal exposure, and you may not know until the provider or a victim tells you.

Your vendors widen the surface. In the ShinyHunters cases, a target’s AI keys were stolen from the target’s enterprise software vendors. Any vendor that holds an AI key on your behalf is part of this risk.

What To Do — One Key Action  

Find every AI key your organization has exposed, starting where attackers look first: public code repositories, mobile apps, container images, websites and chatbots. Run secret scanning across all of them, revoke and rotate anything you find, and move the replacements into the vault you already use for production credentials. Then ask each vendor that holds an AI key on your behalf how it stores, scopes and rotates that key.

Anthropic’s own guidance is to treat AI keys and agent integrations as seriously as production credentials, “because attackers treat them with the same level of seriousness, too.”

MITRE ATT&CK  

  • T1552.001 — Unsecured Credentials: Credentials In Files · T1496 — Resource Hijacking: Keys left in code, apps and containers are harvested at scale, then used to run attack workloads on the victim’s AI compute. The theft is old tradecraft; the AI key is simply the newest credential worth stealing.

Learn More  

Powered by FIR Risk Platform — AI-driven threat intelligence for enterprise risk leaders.