Anthropic: stolen AI API keys become the attack currency

Anthropic's fourth AI misuse threat-intelligence report (September 2026) documents a criminal AI supply chain built on stolen API keys and session tokens. A hacktivist campaign ran for a month on stolen keys, and ShinyHunters affiliates moved their attack workloads onto victims' keys. All keys were stolen from Anthropic customers' environments; Anthropic's own systems were not compromised.

• Report covers operations from December 2025 to August 2026 across seven harm areas
• Group GTG-50021 sold cheap Claude access while harvesting credentials
• GTG-50020 hit about 30 AI companies in roughly four days via LiteLLM
• Stolen keys provide resale inventory, free compute and false attribution