Your AI agent's API key is a production credential — attackers already treat it as one

What Anthropic found

Anthropic's September 2026 threat report carries a blunt instruction for any company running AI agents: treat AI keys and agent integrations with the same seriousness as production credentials. The report says attackers who obtain AI credentials gain three things at once — loot, compute, and cover. That is the whole threat model in one line: a stolen key is money, it is free computing, and it is a disguise. m:…1892

The report names the actor that makes the point concrete. GTG-50020, a Russian-speaking financially motivated group with a history of intrusions against hotel booking and fintech platforms, exfiltrated production API keys from an AI vendor's evaluation sandbox, then attacked approximately thirty AI companies in about four days using similar techniques. Anthropic says the group never gained access to a pre-release Claude model, but it did not need to — the keys were the prize. Suspected ShinyHunters affiliates used stolen AI keys to run secondary attacks on other organizations, and hacktivist actors used stolen keys and local proxies to blend malicious traffic with the legitimate owner's traffic. m:…1892

Why the old checks miss it

The same report shows why the usual safety checks miss this kind of attack. Anthropic found that safeguards performed less consistently when malicious work was fragmented across later, smaller sessions. One actor, GTG-30006, used free Claude accounts across 16 organizations to develop malware and phishing portals by breaking the work into individually benign requests. A PRC-aligned actor reversed a refusal by re-prompting the model until it produced guidance naming 10 private citizens. The report covers activity disrupted between December 2025 and August 2026, and its lesson is structural: per-action checks cannot see intent spread across a sequence of actions. m:…1753

The governance problem underneath is that most companies do not know what they have. Oak, an identity security firm, argues that MCP servers should be governed as machine identities, because their tokens function as entitlements — and credential sprawl follows from servers holding long-lived, shared tokens to downstream systems without clear ownership. Its proposed lifecycle is unglamorous: inventory, owner, scope, usage review, expiry, retirement. The scale of the sprawl is the argument for doing it: a 2026 survey found 109 machine identities per human, and 40% of machine identities have access to organizational data. Credential abuse appears in the attack chain of 39% of breaches, according to the 2026 Verizon DBIR. m:…7202

What changes now

Oak's inventory prescription is similarly plain. Inventorying agents requires continuous discovery and recording each agent as an identity, with five fields on every row: an accountable human owner, who the agent acts on behalf of, its effective permissions, its tool usage, and where it is deployed. Shadow AI agents often run on their builder's credentials, which means the blast radius of a stolen key is whoever built the agent. The framework also points to the NIST AI risk management framework, which requires mechanisms to inventory AI systems. m:…0466

The implication for executives is that agent governance is now identity governance, not a side project for the AI team. OpenBox makes the same point from the vendor side: it argues governance should focus on agent operations and identity rather than just key management. The evidence suggests the fix is boring and urgent at once — count the keys, name an owner for each, give each an expiry date, and watch what agents do across sessions rather than one action at a time. The attackers have already done the counting. m:…1892 m:…7202