Your API key just became a commodity on someone else's resale market

Anthropic published its September 2026 threat intelligence report this week, and buried in the cyber operations section is a detail every team shipping an AI feature should sit with: criminals are stealing production API keys from AI vendors and their customers, then reselling access to that stolen compute through fraudulent resellers. Two separate operations, tracked as GTG-50020 and GTG-50021, ran this as a business model. Not a one-off breach. A supply chain.

The entry point in several cases wasn't a stolen laptop or a phished admin. It was prompt injection against LiteLLM deployments, used to trick the gateway into leaking the production credentials sitting behind it. Once a key is out, it doesn't get used to spin up one chatbot. It gets used as attack compute, sold on, and burned running someone else's workload on your bill.

Why this is a builder problem, not a vendor problem

It's tempting to read this as "Anthropic's problem to fix." It isn't. If you've wired an LLM gateway, a proxy layer, or a wrapper service into your product, you have the same exposure these victims did. Most teams treat an API key like a config value: drop it in an env file, maybe put it in a secrets manager, rotate it if someone remembers. That's the security posture of 2021. It doesn't hold up against an attacker who can reach your gateway through the same prompt input your users are typing into it.

The uncomfortable part is that a leaked key doesn't announce itself the way a stolen database does. Usage looks like usage. Nobody notices until the invoice arrives, or until your key shows up rebranded on a reseller's storefront.

What actually changes your exposure

A few things, none of them exotic, most of them skipped because they're annoying:

Scope keys tightly per environment and per service. A single key with access to every model and every project is a single point of failure for your entire AI surface.
Put short TTLs on keys that touch anything customer facing, and automate the rotation. If rotating a key requires a human to remember, it won't happen often enough.
Treat your LLM gateway like the internet-facing service it is. Prompt injection isn't a jailbreak curiosity anymore, it's an extraction technique aimed at your credentials. Isolate the gateway from anything with standing access to production secrets.
Alert on cost and token anomalies the way you'd alert on unusual database egress. A sudden spike at 3am from a region you don't operate in is not "high usage," it's a signal.
Have a kill switch. Know how fast you can revoke a key and cut an attacker off, because the difference between a two-hour incident and a two-day one is whether that path already exists.

None of this is about distrusting the models. It's about recognizing that agentic AI has compressed the time between "credential leaked" and "damage done" to hours, sometimes less. The report notes attackers moving from initial access to full data exfiltration in two to three hours, with a single operator running dozens of victims at once. Your incident response timeline was probably built for a slower era.

The takeaway

Every team building with AI right now is, functionally, running a piece of critical infrastructure, whether or not they've labeled it that way internally. The threat report is a reminder that the attackers have already updated their playbook for agentic AI. Most product teams haven't updated theirs for defense.

We're here to help founders and teams design and build digital products that are built to scale with you, not slow you down. If you're looking to build something, get in contact with us today!