Anthropic: AI agents harvested thousands of credentials in six hours

Anthropic's September 2026 threat-intelligence report describes agent-driven attacks that harvested thousands of third-party credentials in about six hours using the victim's own cloud. The GTG-50014 cluster's infrastructure managed more than 23,800 harvested keys and API keys, including AI model credentials.

• Agents harvested thousands of credentials in six hours via the victim's cloud
• Attacker dashboard managed over 23,800 harvested keys and API keys
• GTG-50014 downloaded ~1.8M Android packages and scanned them with TruffleHog
• From one stolen developer token to full cloud admin control in under three hours