The victim here builds AI products for a living. Its own automated evaluation pipeline still handed its production credentials to an attacker who simply asked for them in the input it was supposed to be grading.
What the source says
Anthropic's September 2026 threat intelligence report ("Detecting and countering misuse of AI," covering December 2025–August 2026) documents an actor it tracks as GTG-50020 — a financially motivated, Russian-speaking operator with a prior record extorting hotel-booking and fintech platforms (one prior intrusion moved ~26 GB and demanded $1.5–2.5M), who "redirected the same tradecraft towards the AI industry."
In the report's own words: "By injecting malicious instructions into an AI vendor's automated evaluation sandbox, the actor caused the sandbox to hand over the credentials it held — including the production AI API keys from multiple providers belonging to that vendor." The sandbox's job was to process input and evaluate it. It read attacker-controlled content, treated the instructions embedded in it as its own, and disclosed the secrets sitting in its runtime. Content became command — the exact mechanism behind the Cursor DuneSlide sandbox escape already in this database (STUPID-2026-0096), except here it happened in production, against a company that builds the thing that failed.
The keys didn't just leak — they got used. The actor's tooling "automatically switched to using the victim's keys instead of their own," continuing the intrusion against the vendor and against unrelated targets simultaneously, billed to the victim and wearing the victim's identity. A follow-on campaign from the same infrastructure then "attacked roughly thirty AI companies in about four days," reusing the one attack path that worked with small adaptations per target. Anthropic names three things stolen AI credentials buy an attacker: loot (resale), compute (someone else pays), and cover (someone else gets blamed) — and flags that "the integrations customers build around AI such as sandboxes, proxies, and resellers are part of the attack surface."
The actor's stated goal — pursued across "more than a dozen avenues" — was access to a pre-release Claude model. Anthropic states plainly this never happened: "every attempted path failed," the stolen keys "were customers' keys stolen from customers' environments," and "the actor never compromised Anthropic's own systems." Anthropic banned the accounts and published the attacker's egress IPs, with logged activity spanning 2026-05-21 to 2026-06-16.
What it doesn't establish
The victim vendor and the specific evaluation framework are not named — Anthropic's report doesn't identify them, so this entry is filed under unknown-agent, and there's no independent confirmation beyond Anthropic's own writeup. There is no reproduction case here by design: this is a real-world incident report, not a bug someone can re-trigger. The report also doesn't specify the exact injection payload or where in the pipeline the credential handoff happened, so the precise technical fix (input sanitization, credential scoping, sandbox isolation) is not spelled out.
Why it's worth taking seriously
This isn't a lab demo of prompt injection — it's the same failure class that shows up across this database's dozens of agent incidents (content read as data becomes an instruction the agent executes), except the target this time was an AI vendor's own production credential store, and the blast radius was thirty other companies. If your evaluation, grading, or agentic pipelines process third-party or attacker-reachable content and sit anywhere near production credentials, this is the incident to point at when asking whether that pipeline can disclose secrets it merely has access to.
Top comments (0)