Anthropic’s September 2026 threat report describes criminals stealing customers’ AI API keys and running their own attacks on the victims’ accounts. We read it as a plain instruction for Canadian teams: manage AI API key security the way you manage your cloud admin credentials.
- Anthropic says attackers took AI API keys from customer environments, never from Anthropic’s own systems, and one stolen key was used for about three weeks of further attacks.
- Exposed keys were found in public code, mobile app files, Docker containers, websites and chatbots.
- Fake “discount” AI resellers were used to plant credential-stealing software that posed as tools such as Claude Code.
For years, the classic cloud breach began with an access key pasted into a public code repository and picked up by automated scanners. Anthropic’s new report, Detecting and countering misuse of AI: September 2026, says the same thing is now happening to AI keys, with one difference: a stolen AI key hands the thief a capable assistant, billed to you. The report covers activity Anthropic disrupted between December 2025 and August 2026. Anthropic’s API key safety guide covers rotation and secret storage and is a short read for whoever owns your keys.
What the report says happens to stolen AI keys
Anthropic describes criminal groups for whom access to AI, through “compromised API keys, session tokens, and devices,” has become “the sole objective.” Those keys are sold through brokers to fraudulent reseller networks, which use them until the usage runs out. In one case a hacktivist campaign “ran for a month entirely on stolen API keys.” In another, an attacker who stole a target’s key used it for roughly three weeks to attack other organizations, including a French retail chain.
The report is careful on one point, and it deserves the same care here. In every instance it describes, the keys were taken from customers’ environments. Anthropic says its own systems were not compromised.
Where the keys leaked from
Most often, Anthropic says, keys came from legitimate customers who exposed them by accident “in their products, applications and public code such as GitHub, mobile application install files, Docker containers, websites, and chatbots.” One actor built a scanner just to search public containers for valid keys and then routed its traffic so it blended in with the real owner’s usage. Key theft often starts with fake bots, and fake AI crawlers are asking sites for their password files.
Two other routes matter for buyers:
- Fake resellers. Sites offered discounted access to frontier models. Visitors who installed the “client” got a credential stealer posing as a popular AI tool, including Claude Code, which kept sending new keys and sessions to the attacker after the old ones were reset.
- Wrapper services. Attackers used prompt injection against AI wrapper services’ LiteLLM setups to pull out the production keys stored in their cloud containers.
Anthropic’s own advice is direct:
“Organizations should treat AI keys and agent integrations with the same level of seriousness as they do production credentials—because attackers treat them with the same level of seriousness, too.”
It adds that AI access “should be purchased only through authorized channels.” That is a vendor recommending you buy from vendors, so we note the interest. The underlying point still holds: a discount that requires routing your credentials through an unknown intermediary puts your data in that intermediary’s hands.
What this means for Canadian teams
Many small Canadian firms now have AI keys scattered across a website chatbot, a Zapier flow, a developer’s laptop and a contractor’s prototype. Each one is a bill someone else can run up, and a door to whatever that integration can read. Under Canadian privacy law, the business that collected client information stays accountable when it leaks through a third-party tool. The vendor questions in the privacy commissioner’s AI vendor checklist apply to the reseller and wrapper services above too.
What we ran and what we didn’t: we read the full report and checked the quoted passages against it. We did not test any reseller, scanner or wrapper service, and we have no independent count of how many Canadian keys have leaked.
The Limitation
The report tells us what Anthropic saw on its own platform. It cannot tell a business whether its own keys are already in a broker’s list, and it gives no figures on how often stolen keys come from small firms versus large ones. Only your own usage logs can answer that, which is why the test below starts there. A breakdown by customer size, from any AI vendor, would make the risk easier to price.
What would change our mind
If the major AI vendors made short-lived, scoped keys the default for new projects, with spending caps set automatically, a leaked key would be worth much less and this advice would shrink to a checkbox. We would look for that in vendor console updates through the rest of 2026.
Pair this with the controls in our AI agent security checklist and the spending view in our AI agent token budget column, since a stolen key shows up first as a bill. More tool coverage is in AI Tools and Reviews and our AI for business guide.
Buyer’s test
List every AI API key your company has issued, from each vendor’s console. For each one, write down where it lives, who owns it and whether it has a spending cap. Then run a secret scanner, such as GitHub’s own secret scanning, over your public repositories and your website code. Pass if every key has an owner and a cap and the scan finds no keys in public code. One afternoon.
Keys are not the only way in: how a photo upload opened a path into OpenAI. Update: an agent can hide a key from scanners, so read why secret scanning should be your last check, not your first.
FAQ
How do attackers get AI API keys?
Anthropic’s September 2026 report says most come from keys customers exposed by accident in public code, app files, containers, websites and chatbots, plus credential-stealing software and attacks on wrapper services.
Was Anthropic hacked?
Anthropic says no. In every case in the report, the stolen keys came from customers’ own environments.
Are discounted AI resellers safe to use?
Anthropic warns that some fake resellers delivered credential-stealing software. Routing your keys or traffic through an unknown intermediary exposes your data to it.
What is the first step for AI API key security?
Make a list of every key, who owns it and where it is stored, set a spending cap on each, and scan public code for exposed keys.
