Sophistication Stopped Telling You Who

Most stolen credentials are worth what they unlock. A stolen model API key is worth more than that, and the report sets out why in three words. It is loot: there is an established resale market, and brokers feed fraudulent reseller networks that rotate keys until each is exhausted. It is compute: the attacker’s own workloads run on the victim’s account, at the victim’s expense, at whatever scale the victim’s limits allow. And it is cover: the traffic carries the legitimate owner’s name, so the first party investigated is the party that was robbed. One hacktivist campaign ran for a month entirely on keys taken from other people. A criminal crew, on stealing a victim’s AI keys during an intrusion, simply switched its own attack workloads onto them. Another actor compromised an AI company’s evaluation sandbox and took the production keys first, then ran a follow-on campaign against roughly thirty AI companies in about four days — finding one path that worked and repeating it with small adjustments. Its declared goal, pursued down more than a dozen avenues, was access to an unreleased model; it never got there, and the keys it did take were customers’ keys from customers’ systems throughout. Read against that, “treat your model keys like production credentials” stops being boilerplate. The attacker already does.

• 3things a stolen model key is at once: goods to resell, compute billed to the victim, and someone else’s name on the traffic
• ~30AI companies attacked from one infrastructure in about four days, by repeating a single working path

Anthropic’s reading is that the gap has closed: publicly available offensive agent frameworks reproduce the scaffolding for anyone who downloads them, several of the operations in its report ran on them or on derivatives, and “the capabilities described in this report should be assumed to be available to any actors who are motivated to use them”. Google’s threat intelligence group, publishing two days earlier on an entirely different platform, describes the same three behaviours — agentic workflows replacing prompting, API credentials exfiltrated as an objective in themselves, victim cloud environments co-opted to run the attacker’s AI workloads — and reaches a more conservative conclusion, saying it has not observed state-backed or information-operations actors achieving breakthrough capabilities that fundamentally alter the threat landscape. Both can be true. Two organisations looking at different telemetry agree on what the machinery is and disagree about what it has already done, and the second half of that is the part a reader should hold loosely. It is also worth noticing what the disagreement is not about: neither vendor suggests the models invented their own objectives. Anthropic’s own caveat is that humans kept the decisions that mattered to them — choosing targets, converting theft into money, checking the results — and that autonomy and harm are separate axes. Autonomy multiplied the scale and dropped the cost. It did not supply the intent.

• 2 daysbetween the two vendors’ publications, on different platforms, describing the same three behaviours

Two things follow from putting the three side by side, and neither is in any one of them. The first is that the vendors are already working together: Microsoft’s report ends by thanking Anthropic and OpenAI for their collaboration on the investigation, which means two competing model providers and a platform provider worked the same intrusion before any of them wrote it up. Set that beside the disclosure gap in the wider industry — incident reporting is voluntary nearly everywhere — and the private cooperation is running ahead of the public rule. The second is subtler and is this report’s most under-discussed finding. In the cyber and weapons cases the harm falls on a third party: a ministry, a manufacturer, a hotel guest. In the distillation cases it falls on the model’s other users. If a company silently forwards its customers’ requests to another provider, those customers’ data crosses a border they never agreed to. The report gives two examples of what then arrived: a user it assesses as likely affiliated with the Chinese military, loading footage from hundreds of Chengdu cameras about one tracked individual and asking whether the person was behaving abnormally; and an operator handling data for a Russian defence-associated agency whose relayed requests exposed live credentials to a government database. Whatever one concludes about the training-data dispute, that is a privacy failure with named consequences, and it happened to people who had no idea they were involved.

• hundredsof cameras whose footage of one tracked person reached a third company’s servers, because the user did not know where their request was going

For a defender, the practical loss here is a heuristic. When capability was scarce, the quality of an operation told you something about who was behind it, and that shortcut shaped how intrusions were triaged, escalated and reported for years. If a lone operator with a downloaded framework and somebody else’s API key can run a multi-victim campaign that looks like a state programme, the shortcut is gone, and nothing cheap replaces it. What is left is intent, and intent is not visible in a packet capture: it is recovered afterwards, from targeting, from what was taken, from what the operator did with it. That is slower and more expensive work, and it is now the work. The report is worth reading with its authorship in view — it is published by the vendor whose product was misused, it names competitors, and it describes safeguards it sells — but the finding does not depend on trusting it, because a rival vendor with no stake in Claude published the same mechanisms two days earlier from its own telemetry. On the question of how far this has already gone, the two disagree, and a reader is entitled to hold that part loosely.