{
 "public_id": "AIR-2026-0235",
 "incident_id": "2026-09-anthropic-gtg-50020-ai-supply-chain",
 "date_disclosed": "2026-09-10",
 "date_occurred": null,
 "title": "GTG-50020: Russian-speaking actor pivoted from hotel/fintech intrusions to the AI supply chain, using agentic pentest loops to steal AI vendors' production API keys and hunt a pre-release Claude model",
 "class": "in_the_wild",
 "attack_surface": "agent_framework",
 "initial_vector": "prompt_injection_of_ai_evaluation_sandbox_and_autonomous_exploitation",
 "agent_capability_abused": [
  "autonomous_exploitation",
  "prompt_injection",
  "credential_theft",
  "code_execution",
  "parallel_target_iteration"
 ],
 "target_product": "Claude / AI vendor evaluation sandboxes",
 "target_vendor": "Anthropic",
 "autonomy_level": "fully_autonomous",
 "impact_realized": true,
 "impact_type": [
  "credential_theft",
  "unauthorized_access",
  "data_exfiltration",
  "extortion"
 ],
 "blast_radius": "roughly 26 GB exfiltrated from one hotel/fintech victim with $1.5-2.5M extortion demands; production AI API keys stolen from an AI vendor's evaluation sandbox; a follow-on campaign hit roughly thirty AI companies in about four days; the actor's goal of accessing a pre-release Claude model was never achieved",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI01",
   "ASI04",
   "ASI05",
   "ASI03"
  ],
  "mitre_atlas": [],
  "labels": [
   "ai_supply_chain",
   "api_key_theft",
   "eval_sandbox_injection",
   "agentic_offense",
   "extortion"
  ]
 },
 "defense_present": "Anthropic Usage Policy safeguards; AI vendor evaluation-sandbox controls",
 "defense_bypassed": true,
 "fix_shipped": "Anthropic disrupted the activity and reports its own systems were never compromised; stolen keys belonged to customers (September 2026)",
 "primary_sources": [
  "https://www-cdn.anthropic.com/e50be2e51e7695dc4b1366a37a245a597377d3b5/Anthropic-Detecting-and-countering-091026.pdf",
  "https://www.anthropic.com/threat-intelligence-report-september-2026"
 ],
 "verified_quote": "By injecting malicious instructions into an AI vendor’s automated evaluation sandbox, the actor caused the sandbox to hand over the credentials it held—including the production AI API keys from multiple providers belonging to that vendor.",
 "confidence": "high",
 "notes": "Anthropic September 2026 report (PDF). impact_realized=true for the real 26 GB hotel/fintech data theft and the theft of production AI API keys from an AI vendor's sandbox; the stated ambition to reach a pre-release Claude model was explicitly never realized. Used a human-directed AI pentest loop and an autonomous exploitation pipeline (injection/XSS/auth-bypass/SSRF) run against production. Anthropic states its own systems were not compromised and stolen keys were customers' keys.",
 "risk_category": "security_fraud",
 "risk_secondary": [
  "privacy"
 ],
 "risk_subcategory": "Prompt Injection",
 "risk_sub_secondary": [
  "Supply Chain Compromise",
  "Credential & Secret Theft",
  "Remote Code Execution & Sandbox Escape",
  "Unauthorized Access & Account Takeover",
  "Ransomware & Extortion"
 ],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": true,
 "agency_reason": "automated exploitation and credential-validation workflows performed the intrusions; extortion was human",
 "vector_family": "indirect_prompt_injection",
 "vector_detail": "prompt_injection_of_ai_evaluation_sandbox_and_autonomous_exploitation",
 "guardrail_kind": [
  "sandbox_isolation",
  "abuse_detection"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI01",
 "agent_framework": "unknown",
 "model_provider": "anthropic",
 "model_name": "",
 "detection_mechanism": "vendor_disclosure",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "data_exfiltration_channels",
 "eai_domain": "privacy",
 "eai_secondary": [
  "credential_theft",
  "privilege_escalation",
  "supply_chain_vulnerabilities"
 ],
 "eai_reason": "impact rule: data_exfiltration_channels",
 "asi_curated": [],
 "asi_scope": "in_scope",
 "asi_provenance": "rule",
 "asi_reason": "ASI01 (vector_family=indirect_prompt_injection); ASI04 (vector=supply_chain); ASI05 (vector=code_exec); ASI03 (signal=identity)",
 "submitted_by": "EAI Internal"
}