Anthropic: prompt injection exposed an AI vendor’s API keys

Anthropic says a criminal group it tracks as GTG-50020 stole an AI vendor’s production API keys by planting instructions in the vendor’s automated evaluation sandbox. The case is in Anthropic’s threat report for September 2026, which covers misuse of its models that it disrupted between December 2025 and August 2026.

According to Anthropic, GTG-50020 is a Russian-speaking, financially motivated actor that had previously attacked hotel booking and financial technology platforms. The injected instructions made the sandbox hand over the credentials it held, including the vendor’s production keys for several AI providers. The group then used those keys for its own attack traffic while it kept up intrusion attempts against the vendor and other targets.

A follow-on campaign from the same infrastructure hit roughly thirty AI companies in about four days, repeating one attack path that had worked. Anthropic says the group’s stated goal was access to a pre-release Claude model: “The actor never gained access; every attempted path failed.” It adds that the keys involved were stolen from customers’ environments and that its own systems were not compromised.

The same report describes several actors who used prompt injection against AI wrapper services built on LiteLLM to extract the production API keys in their cloud containers. Anthropic advises treating AI keys and agent integrations with the same care as other production credentials.

The report does not name the AI vendor or the thirty companies, so none of them has confirmed the account, which rests on Anthropic’s own investigation.