In the wild
Realized harm
GTG-50020: Russian-speaking actor pivoted from hotel/fintech intrusions to the AI supply chain, using agentic pentest loops to steal AI vendors' production API keys and hunt a pre-release Claude model
AIR-2026-0235 AIR record · 2026-09-anthropic-gtg-50020-ai-supply-chain
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
By injecting malicious instructions into an AI vendor’s automated evaluation sandbox, the actor caused the sandbox to hand over the credentials it held—including the production AI API keys from multiple providers belonging to that vendor.www-cdn.anthropic.com
The record
Disclosed
2026-09-10
Vendor
Anthropic
Product
Claude / AI vendor evaluation sandboxes
Risk domain
Privacy › Data exfiltration channels
Also touches
Credential theft, Privilege escalation, Supply chain vulnerabilities
System type
Generative model
Who acted
Agent acted (contested) — automated exploitation and credential-validation workflows performed the intrusions; extortion was human
Attack surface
Agent framework
Autonomy level
Fully autonomous
Initial vector
Prompt injection of ai evaluation sandbox and autonomous exploitation
Impact type
Credential theft, Unauthorized access, Data exfiltration, Extortion
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
roughly 26 GB exfiltrated from one hotel/fintech victim with $1.5-2.5M extortion demands; production AI API keys stolen from an AI vendor's evaluation sandbox; a follow-on campaign hit roughly thirty AI companies in about four days; the actor's goal of accessing a pre-release Claude model was never achieved
Capability abused
Defense & remediation
Recorded defense
Anthropic Usage Policy safeguards; AI vendor evaluation-sandbox controls
Guardrail kinds
Sandbox isolation, Abuse detection
Guardrail outcome
Silent
Fix shipped
Anthropic disrupted the activity and reports its own systems were never compromised; stolen keys belonged to customers (September 2026)
Taxonomy & references
Curator notes
Anthropic September 2026 report (PDF). impact_realized=true for the real 26 GB hotel/fintech data theft and the theft of production AI API keys from an AI vendor's sandbox; the stated ambition to reach a pre-release Claude model was explicitly never realized. Used a human-directed AI pentest loop and an autonomous exploitation pipeline (injection/XSS/auth-bypass/SSRF) run against production. Anthropic states its own systems were not compromised and stolen keys were customers' keys.
Supporting sources
Cite as
Enkrypt AI. "GTG-50020: Russian-speaking actor pivoted from hotel/fintech intrusions to the AI supply chain, using agentic pentest loops to steal AI vendors' production API keys and hunt a pre-release Claude model". AIR, AIR-2026-0235. https://agentincident.vercel.app/i/AIR-2026-0235/ (accessed 2026-10-19).