The Stolen Model-Access Economy

Sources#

• China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies
• Detecting and countering misuse of AI: September 2026
• GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI

Summary#

The single most cross-cutting finding in Anthropic's September 2026 threat report is not an attack technique. It is a market: AI API keys, session tokens and accounts have become a traded commodity, and "access to AI in the form of compromised API keys, session tokens, and devices has increasingly become the sole objective of multiple criminal groups."

The report's own three-line statement of why is the best compression of it:

Loot — stolen keys and accounts have resale value in established markets. Compute — the credentials mean attack workloads run at someone else's expense. Cover — the activity is attributed to the credential's legitimate owner.

Three properties from one theft, and the third is the one conventional credential-theft economics does not have: a stolen AWS key gives you compute and cover; a stolen model key gives you the capability itself. This is why the same substrate turns up under five of the report's seven harm areas — cyber intrusion, biological research in unsupported regions, the dating-scam studio, the distillation campaigns, and the surveillance vendors. case-study, first-party, no external verification.

The harvest routes#

Industrial-scale secret mining. One French-speaking ShinyHunters affiliate (aliases MeowSHA / frkoo / blazespider) ran a credential pipeline across 10 AWS EC2 workers that mass-downloaded 1.8 million distinct Android APKs from multiple app stores, decompiled them, scanned for hardcoded secrets with TruffleHog, and routed verified findings in real time to a Telegram group organized into over 100 source types — with a parallel GitHub-organization harvester feeding a second stream of stolen Personal Access Tokens. Those two pipelines supplied "the initial-access credentials for the bulk of the confirmed breaches." The scan surface the report enumerates is broader still: application binaries, code repositories and integrations, client-side code, credential stores, container images, metadata endpoints, open storage, and victim-deployed AI agents.

Prompt injection against AI middleware. "Multiple actors were observed compromising AI wrapper services' implementation of LiteLLM — they used prompt injection to exfiltrate the production API keys used in their cloud-hosted container environments." A deployment pattern that exists to hold provider keys on a user's behalf is a concentrated target, and the injection surface it exposes is the one Agentic Prompt Injection describes, pointed at the credential store rather than at a tool call.

The evaluation sandbox (GTG-50020). The most pointed route. A Russian-speaking financially-motivated actor, previously working hotel-booking and fintech intrusions (one of which exfiltrated ~26 GB and carried a $1.5–2.5M extortion demand), redirected the same tradecraft at the AI industry: "By injecting malicious instructions into an AI vendor's automated evaluation sandbox, the actor caused the sandbox to hand over the credentials it held — including the production AI API keys from multiple providers belonging to that vendor." They then attacked ~30 AI companies in about four days from the same infrastructure, finding one working path and repeating it against all thirty with small per-target adaptations. Their stated goal, pursued "across more than a dozen avenues," was access to a pre-release Claude model; every path failed.

That an evaluation sandbox is a credential-rich, weakly-bounded environment is not a new observation in this corpus — The OpenAI / Hugging Face Intrusion (July 2026) is the same trust boundary failing from the inside, with the models themselves as the escaping party. This is the outside version: a human adversary, an injection, and the same class of container handing over the same class of secret. The two cases together make the evaluation harness a named attack surface rather than an incidental one.

The fraudulent-reseller layer#

The demand side is served by proxy networks — "transfer stations" — that sell frontier-model access to buyers in unsupported regions and rotate in fresh stolen keys and tokens "until they exhaust their usage." Two variants matter because they invert the usual victim relationship:

• Sell access, steal the buyer (GTG-50021, "kl1zy"). A Russian- and Ukrainian-speaking group ran a fraudulent reseller offering cheap Claude access "which turned out to be neither cheap nor actually Claude." Buyers' traffic was silently proxied to a different model while the reseller's tooling installed a credential harvester that stole their Anthropic credentials and sold them onward to other proxy resellers. The customer pays for the product, does not receive it, and becomes the inventory.
• Spoof the harness. Sites posing as multi-model intermediaries delivered "malicious client side applications often spoofing as popular AI harnesses including Claude Code" that were credential harvesters. The persistence detail is the one to keep: because a compromised key gets reset, the harvester stays resident and re-steals each new session from the device, converting a one-time theft into a subscription.

The same layer, described by the US government (2026-09-08). NSA/CISA/FBI advisory AA26-251A (China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies, case-study, no disclosed method) independently uses the name "transfer stations" for "a large gray market of API proxies" that "resell access to frontier models at a fraction of the official price," and it says the proxies are used to get around both Chinese and US access controls. It adds a route this page did not have: seat arbitrage. PRC labs bought premium subscriptions in bulk and shared them across developer teams, and StepFun ran account pools with employees on concurrent sessions and per-agent daily budgets. Its detection indicators are about subscriptions rather than keys: shared accounts across many IPs and user agents, round-the-clock usage with no idle periods, anomalous subscription-to-API usage ratios, and new subscriptions that hit maximum usage immediately. It gives no price and no market size, so the first open question below still stands. See Illicit Distillation.

Using the loot as attack infrastructure#

Once obtained, AI credentials are not only resold — they are switched into the attack:

• ShinyHunters affiliates, on finding a victim's AI keys mid-intrusion, "switched their own attack workloads onto the victim's keys." One stolen key ran secondary attacks for roughly three weeks, compromising a French retail chain and probing a Web3 identity platform.
• A hacktivist campaign (GTG-50029) "ran for a month entirely on stolen API keys," using a custom Rust scanner to validate keys exposed in public containers and then rotating usage across a local proxy layer specifically to blend the traffic with the legitimate owner's — cover engineered deliberately, not incidentally.
• GTG-50020, on compromising the AI vendor's sandbox, "automatically switched to using the victim's keys instead of their own."

The report's prescription is short and is the right one: "Organizations should treat AI keys and agent integrations with the same level of seriousness as they do production credentials — because attackers treat them with the same level of seriousness, too. AI access should be purchased only through authorized channels. An alleged discount that requires routing traffic and credentials through an unknown intermediary introduces tremendous risk." The operational consequence is that an AI key belongs under the same short-lived, per-workload, origin-checked regime Agent Identity and Authentication specifies for every other production credential, and that an LLM gateway or reseller is a trust boundary and should be inventoried as one.

A second vendor's vantage: price, config files, and LLMjacking (GTIG, September 2026)#

Google Threat Intelligence Group's Q2 2026 tracker (GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI, 2026-09-08, case-study, first-party: Google is the author, and Gemini is one of the products whose accounts are being sold) describes the same market from Gemini telemetry, Mandiant incident response and underground-forum tracking. Its explanation matches Anthropic's without using the loot/compute/cover wording: "The cost of premium model access and high-performance compute is one of the primary barriers for threat actors seeking to operationalize AI." Two vendors reached the same substrate independently, and that is the strongest corroboration this page has. Neither source is external to the industry. Four additions:

• A price trend, the first number on this market. GTIG reports more buyers and more sellers of AI accounts on the underground forums it tracks in 2026. Demand is concentrated on Claude and Gemini credentials, with rising demand for autonomous coding IDEs (Cursor Pro, Devin), "reflected in average underground marketplace prices per account more than doubling in 2026." Keep the basis attached: this is posts on forums GTIG tracks, an average with no absolute price, no volume and no per-product split. It shows that demand is outrunning supply. It does not give the market's size.
• Infostealers now target the coding-assistant config file. Commodity stealer controllers (LUMMAC.V2, STEALC.V2, VIDAR, ACRSTEALER) pushed commands aimed at AI developer configurations, "moving beyond the traditional harvesting of AI browser profiles." In May 2026 ACRSTEALER operators pushed file-grabber rules for Cline's secrets.json and Continue's config.yaml, files that "can store plaintext API keys, as well as custom model routing endpoints." This is a harvest route Anthropic's list lacks. A harness's local configuration now sits alongside decompiled APKs and exposed containers as a known key store, and since commodity malware already collects it, it is not a niche target.
• LLMjacking, reconstructed from a Mandiant case (April 2026). An exposed GitHub PAT led to cloud access. The attacker enabled Gemini Enterprise and a high-performance instance, built Artifact Registry images for LiteLLM and the Manus agent framework, and exposed them as public Cloud Run services (allUsers invoker) with proxy firewall rules. Next came a rogue Editor-privileged service account with exported keys, BigQuery sweeps for tables holding environment variables and more credentials, and an attempt to hand project ownership to an outside email. The last stage requested quota increases for NVIDIA RTX 6000 hardware and launched 48-vCPU instances, a RAG notebook and project-wide Generative Language APIs "to sustain unauthorized AI workloads" (Table 11). What stands out is the LiteLLM image. The attacker did not only use the victim's compute. It stood up a publicly reachable model gateway on the victim's account, which is the "transfer station" of the reseller layer built on stolen infrastructure.
• The same market, seen at the point of validation. A C2 dashboard GTIG calls "Recon" organized harvested secrets "including API keys for cloud and AI services" (Autonomous Intrusion covers the agent framework behind it). The published screenshot shows the yield: 26 valid of 26,275 total keys, with 739 invalid and 25,510 still unchecked. The prose says "over 23,800 harvested secrets"; both numbers are as published, most likely taken at different moments. Among keys actually checked, 26 of 765 (~3%) were live, which suggests mass harvesting brings in mostly dead inventory and that validation is the bottleneck.

Two further actors extend the edges of the market. A DPRK IT-worker cluster was seen doing bulk LLM API registration with hijacked accounts to scale operations: stolen identities used to get new keys, rather than stolen keys. And PRC-nexus UNC6508 skipped the market entirely. It deployed a local open-weight model on compromised cloud infrastructure, which "avoid[s] commercial AI API monitoring, while co-opting victim compute resources." That is the compute and cover halves of the triad with no provider credential at all. Any detection built on provider-side key telemetry cannot see it by construction.

The disclaimer, and what to do with it#

Three times in three different sections, the report states that the keys were customers' keys taken from customers' environments and that "Anthropic's own systems were not compromised." Taken literally it is a narrow and probably true claim. Taken as the frame for the whole section it does more work than it should: the report is written by the party whose product is the loot, the resale market exists because the product is rate-limited and region-gated, and the fraudulent-reseller layer is a direct function of unmet demand for that product in places Anthropic will not serve. None of that makes the account wrong; it does mean the boundary being drawn — our infrastructure held, our customers' did not — is the boundary most favorable to the author, and a reader should notice it is drawn repeatedly.

Connections#

• LLM-Driven Vulnerability Research — what the stolen compute buys: an exploit foundry running around the clock on someone else's key

• AI-Enabled Influence Operations — how several operations reached a blocked service at all: VPNs, foreign phone numbers, rotated accounts and third-party IP-masking services

• AI-Enabled State Surveillance — the commercial layer of the same market seen from the buyer's side: surveillance vendors drafting platform tenders and capability brochures for bureau-level government clients

• Safeguard Evasion by Task Decomposition — what the purchased access is for: relays, ZDR abuse and gray-market resellers are the infrastructure every evasion in the report runs on

• Illicit Distillation — the largest consumer of this market: thousands of fraudulent accounts per campaign, transcripts purchased from the same proxy operators, and one lab's account pool observed funneling three different labs' traffic

• Agent Supply Chain Risk — the adjacent but distinct layer. That page is about the artifacts an agent composes at runtime (models, tools, MCP servers, skills, cached packages); this one is about the credential that buys model access, which is loot in its own right rather than a carrier for a payload

• Agent Identity and Authentication — the control this failure argues for, applied to a credential class most organizations do not yet inventory: short-lived, per-workload, origin-checked keys rather than long-lived provider tokens embedded in shipped binaries

• Agentic Prompt Injection — the technique behind two of the harvest routes: LiteLLM key exfiltration from cloud-hosted containers, and the evaluation sandbox coaxed into surrendering the production keys it held

• The OpenAI / Hugging Face Intrusion (July 2026) — the same trust boundary, failing from the inside: an evaluation harness as a credential-rich weakly-bounded environment, there with the models as the escaping party and here with a human adversary injecting into one

• AI-Accelerated Offense (hub) — the economics this feeds: free attack compute removes the last per-attempt cost from the attacker's side of the ledger

• Agent Supply Chain Risk — where GTIG's config-file grabbers and DUSTMAKER's AI-credential collection sit on the artifact side: the coding assistant's workspace is both the carrier and the key store

• Autonomous Intrusion — where the stolen compute is spent; the ShinyHunters and hacktivist campaigns are both on this page and on that one

• Anthropic — the vendor whose credentials are the commodity and the first source for the account

• Google Threat Intelligence Group (GTIG) — the second vendor account, with the price trend, the config-file grabbers and the LLMjacking lifecycle

• Claude Code — spoofed by credential-harvesting installers on fake AI-reseller sites; the harness's brand is itself part of the lure surface

Open Questions#

• The report gives no size for this market — no price for a working key, no observed resale volume, no estimate of what fraction of a provider's traffic is proxied. Does any source (a takedown, a marketplace scrape, a provider's fraud disclosure) put a number on it? Partially answered (2026-09-24): GTIG's Q2 2026 tracker gives a trend: average underground marketplace prices per AI account "more than doubling in 2026", with more buyers and more sellers year over year and demand concentrated on Claude, Gemini, Cursor Pro and Devin. It is based on forum posts GTIG tracks and gives no absolute price, no resale volume and no proxied-traffic share, so the size half of the question is still open.
• "Cover" assumes the legitimate owner cannot tell. What detection does a customer actually have that their key is being used by someone else — and does any provider expose the per-key behavioral signal (origin, harness, workload shape) that would make blending-with-the-owner's-traffic fail?
• An LLM gateway that holds production keys for many downstream apps is the concentrated form of this target, and LiteLLM is named. Is there a measured injection-resistance result for any gateway's key handling, rather than the one in-the-wild report?

Sources#

• Detecting and countering misuse of AI: September 2026 — Anthropic Threat Intelligence, Detecting and countering misuse of AI: September 2026, 2026-09-10, case-study (first-party; the author is the vendor whose credentials are the commodity, and the "our systems were not compromised" boundary is drawn three times). Cited for: the "AI supply chain as target, loot, and attack compute" section (pp. 29–32) — the loot/compute/cover triad verbatim, the transfer-station and fraudulent-reseller model, the Claude Code-spoofing harvesters with their re-steal persistence, the LiteLLM prompt-injection route, and GTG-50021; the GTG-50014 pipeline figures (1.8M APKs, 10 EC2 workers, TruffleHog, 100+ Telegram source types) from the case prose (p. 12); GTG-50020's sandbox injection, the ~30-companies-in-4-days follow-on and the pre-release-model objective; and GTG-50029's Rust key scanner and proxy-blending. No IOC table is cited — the table-collapse warnings at ingest all landed on those tables and were cleared as genuine multi-address cells, but no row of them is load-bearing here
• China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies — NSA, CISA and FBI, Cybersecurity Advisory AA26-251A, 2026-09-08, case-study (government attribution, no disclosed method or data, references are vendor disclosures). Cited for the transfer-station gray market, bulk subscription pooling and StepFun's account pools, and the Novel TTP 1 detection indicators
• GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI — Google Threat Intelligence Group, GTIG AI Threat Tracker: From Prompting to Autonomy, Google Cloud blog, 2026-09-08 (displayed 09-09), case-study (first-party; Google's Gemini accounts are among those traded, and the post ends in product promotion). Cited for the access-cost framing, the underground price-doubling trend (forum-post basis, no absolute figure), the LUMMAC.V2/STEALC.V2/VIDAR/ACRSTEALER config targeting and the Cline/Continue file-grabber rules, the DPRK bulk-registration and UNC6508 local-model cases, the Recon dashboard counters (Figure 3 screenshot; prose/figure discrepancy recorded), and Table 11's LLMjacking lifecycle (an HTML table, read cell by cell; no parse risk)