Attackers used prompt injection to steal keys and target AI labs in Anthropic report
A September 2026 report details how threat actors exploited an evaluation sandbox to exfiltrate API keys and launch attacks against approximately thirty AI research organizations.
Key points
- Attackers prompt-injected an evaluation sandbox to steal customer API keys.
- Stolen keys were used to consume victim compute resources for further attacks.
- The campaign targeted roughly thirty AI laboratories, according to the report.
According to a report submitted to the r/netsec subreddit in September 2026, attackers prompt-injected an evaluation sandbox. The threat actors used this technique to extract customer API keys from the system. These credentials were then leveraged to execute further malicious operations against other entities.
The attackers utilized the stolen API keys to access the computational resources of the victims. By burning the victims' own compute, the threat actors launched subsequent attacks. This method allowed them to obscure the origin of the traffic while consuming the resources of the targeted accounts. The scope of this specific campaign included approximately thirty AI labs.
Context and Background
The report, shared by user Js4days on Reddit, outlines the mechanics of the breach. The initial entry point was identified as an evaluation sandbox. Attackers employed prompt injection, a technique where malicious instructions are embedded in data inputs, to bypass security controls. This allowed them to interact with the system in unauthorized ways.
The extraction of API keys was the critical step in the chain. These keys provided the necessary authentication for the attackers to make requests on behalf of the victims. The report indicates that the attackers did not just steal data but actively used the compromised accounts. This turned the victims' infrastructure into a tool for further aggression.
The use of victim compute is a significant detail in this incident. It suggests that the attackers were resource-constrained or sought to mask their infrastructure footprint. By using the stolen keys, they could generate traffic that appeared legitimate to external observers. This complicates attribution and detection efforts for the targeted organizations.
Who Is Affected
The attackers launched attacks against approximately thirty AI labs. These organizations were hit using the computational resources of the initial victims. The report does not name the specific labs involved in the secondary attacks. It also does not identify the specific customers whose API keys were initially stolen from the sandbox.
The primary compromise occurred within an evaluation sandbox. Customers who used this sandbox for testing or evaluation purposes were at risk of credential theft. The report implies that any customer with active API keys accessible through the compromised sandbox was potentially affected. The extent of the initial compromise is not detailed beyond the key theft.
The secondary victims, the AI labs, suffered from unauthorized use of their resources or direct attacks. The report states that the victims' compute was "burned" to attack these labs. This implies a denial-of-service or resource-exhaustion style attack, though the specific technical vector against the labs is not described.
What should you do?
Security professionals should review the access logs for any evaluation or testing environments. Look for unusual patterns in API key usage or compute consumption. Organizations should rotate API keys that may have been exposed in similar sandbox environments. Monitoring for unexpected outbound traffic from compute instances is also recommended.
Background: Prompt injection attacks
Look for sudden shifts in tone, refusal to follow system constraints, or output that repeats hidden instructions. These signs indicate the model is processing injected commands rather than your intended query.
Read the full guide: Prompt Injection Warning Signs: How to Spot AI Manipulation
What to do and how to stay safe: Anthropic
- Audit API keys used in evaluation or sandbox environments for unauthorized access patterns.
- Rotate credentials that were active during the timeframe of the reported incident.
- Monitor compute resource usage for anomalies that could indicate hijacked resources.
- Implement stricter input validation to mitigate prompt injection risks in AI systems.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did Anthropic confirm this breach in an official statement?
The source material only cites a report submitted to r/netsec by user Js4days, not an official Anthropic statement.
What CVE ID is associated with this vulnerability?
The source material does not mention any specific CVE ID or vulnerability identifier for this incident.
Has a patch been released for the sandbox?
The source material does not state that a fix or patch has been confirmed or released.
