TL;DR: Anthropic’s September 2026 threat report says Chinese labs harvested close to 200 million Claude exchanges to train rival models, two of them by silently forwarding their own users’ requests to Claude. A fake “cheap Claude” reseller proxied buyers to a different model and stole their credentials. Every stolen API key in the report came from a customer’s environment, not from Anthropic. And a weapons cell used Claude Code as its whole engineering team. The lessons for API teams are ordinary security discipline, sharpened for a world where AI keys, prompts, and agents are the new attack surface.
The wildest lines in Anthropic’s new report are about missiles and model theft. The useful ones are about your API keys.
On September 10, Anthropic published “Detecting and countering misuse of AI: September 2026”, covering threat activity from December 2025 to August 2026 across seven harm areas. TechCrunch and CNBC led with the distillation numbers. Past the headlines, it’s a field guide to how AI credentials get stolen, resold, proxied, and abused at scale.
We wrote the same kind of breakdown after the OpenAI and Hugging Face incident in July. This one matters to more teams, because the victims were ordinary API customers. Here are seven lessons, each tied to something you can do this week. Apidog appears where it helps and stays out of the way where it doesn’t.
What the report says
Four findings matter for API teams. All of them are Anthropic’s attributions; none of the named labs had responded at the time of writing.
Distillation at industrial scale. Anthropic attributes the largest campaign to Alibaba: chain-of-thought extraction from Claude Opus 4.6 and 4.7, peaking near 3 million exchanges a day from more than 3,500 fraudulent accounts, 151 million exchanges between May and July, used to train Qwen 3.5 through 3.7. Moonshot AI and DeepSeek allegedly went further and forwarded their own customers’ requests to Claude without telling them, with DeepSeek logging 12.1 million exchanges in 14 days.
A fake reseller. A Russian and Ukrainian speaking group tracked as GTG-50021 sold “cheap Claude access” that, in Anthropic’s words, “turned out to be neither cheap nor actually Claude.” Traffic went to a different model while the reseller’s tooling installed a credential harvester and resold the stolen Anthropic logins.
Stolen keys, every time. Across the cyber cases, Anthropic states: “In every instance, the API keys involved were stolen from Anthropic customers’ environments.” One crew mass-downloaded 1.8 million Android APKs to scan for hardcoded secrets.
Agents as an engineering team. A cell in northern Yemen used Claude Code instead of human engineers to write guidance and control software for a guided rocket. The test fire appears to have failed. Within hours they were back in Claude asking why.
Lesson 1: Your AI keys are production credentials now
Anthropic’s guidance is blunt: “Organizations should treat AI keys and agent integrations with the same level of seriousness as they do production credentials, because attackers treat them with the same level of seriousness, too.”
Most teams don’t. AI keys get pasted into notebooks, committed to demo repos, baked into mobile builds, and shared in Slack. The APK-scanning crew exists because that habit is common enough to industrialize.
Start with inventory. Scan every place a key can hide: request headers, environment files, example responses, scripts, docs. If you’re on Apidog’s Enterprise plan, Secret Scanner sweeps requests, environment and team variables, scripts, Markdown docs, and response examples for keys, tokens, and webhook URLs, and points you at the variable or vault reference that should replace them. Then scope what remains, using our least-privilege guide for agent keys.
Lesson 2: A discount reseller is a credential harvester with a pricing page
The report’s advice on where to buy access is one sentence: “AI access should be purchased only through authorized channels. An alleged discount that requires routing traffic and credentials through an unknown intermediary introduces tremendous risk to user data and systems.”
Every prompt you send through an intermediary is readable by that intermediary. Every key you hand it is theirs. GTG-50021’s victims thought they were saving money. They were donating their prompts to a stranger and their credentials to a resale market.
There is a legitimate version of this market. Routers like OpenRouter publish who runs the models, what gets logged, and how billing works; our OpenRouter alternatives roundup covers the ones with a real company behind them. If you can’t name the legal entity holding your traffic, don’t send it.
Lesson 3: Verify which model is answering you
Users on two Chinese platforms were talking to Claude without knowing it, while GTG-50021’s customers thought they had Claude and didn’t. Neither group had a way to check. You do.
Treat model identity like any other API contract, and test it:
- Assert on the response
modelfield. Save a request to the vendor’s official endpoint and the same request to any intermediary. In Apidog, add an assertion on$.modeland run both in one test scenario. A proxy can spoof this field, so it’s a floor, not a proof. - Compare token accounting. Send an identical prompt to both and compare
usage.input_tokens. Tokenizers differ between model families, so a mismatch means a different model is counting. - Check provider-specific structures. Claude returns signed thinking blocks and a
request-idheader. A backend that isn’t Claude can’t produce a signature that validates on a follow-up turn. - Baseline latency and refusal style. Run the scenario on a schedule and alert on drift.
It’s the same contract testing you already do for status codes, moved one layer up.
Lesson 4: A prompt is a log line that leaves your building
When DeepSeek relayed user requests to Claude, the relayed traffic exposed “live credentials for a Russian government database and a PRC police case-management system,” according to the report. Someone pasted production secrets into a chat window, and they crossed at least two companies’ infrastructure.
Your developers do this too. Stack traces with connection strings. Curl commands with the bearer token intact. Config files dropped into an agent’s context to “help it understand.”
The fix is mechanical. Keep secrets in environment or vault-backed variables so they never sit in the prompt text or the saved request. Apidog’s environment and secret variables mask values at rest and in shared exports, and the HashiCorp Vault integration pulls secrets at request time instead of storing them. Whatever tool you use, the standard is the same: a prompt should be safe to publish.
Lesson 5: Reasoning output is an asset and an attack surface
Moonshot’s campaign used what Anthropic calls a cross-session replay attack on Claude’s thinking signatures to pull out reasoning traces. Alibaba’s used a fixed extraction prompt at scale. Anthropic’s countermeasures, per the report, include extraction classifiers, summarized rather than raw reasoning, preserved thinking that resists tampering, and identity verification with bans.
If you build on frontier APIs, expect the surface to keep changing. Raw chain-of-thought will get shorter and more summarized. Signature checks will get stricter, which is why some teams hit the “block is bound to a different conversation” error we covered in the preserved thinking guide. Design your integration so it depends on final answers and structured outputs, not on the exact shape of reasoning blocks.
Lesson 6: An agent team needs a human review gate
The rocket cell is the report’s darkest case, but strip the target away and it describes a workflow thousands of legitimate teams now run: several Claude Code sessions acting as the engineering team, shipping code nobody reviews, until a test fails and the agents are asked to debug their own work.
For a weapons program, the missing reviewer is the point. For your team, it’s the risk. Once multiple agents write code and hold credentials, the questions become operational: which agent is working on what, in which repo, what finished, what failed, and what is waiting for a human to look at it before it ships.
That’s a management problem, not a model problem, and it’s the one Sharkly is built for. It sits above the agents you already use, Claude Code, Codex, Gemini CLI and others, assigns work to them like teammates, runs each task in an isolated git worktree on your own machines, and keeps progress, blockers, and human review visible from request to release. Nothing merges because an agent said it was done. If your agents are a team, give them a manager.
Lesson 7: Baseline what normal usage looks like
Anthropic didn’t catch 3,500 fraudulent accounts by reading prompts. It caught them through “behavioral signatures,” metadata-based attribution of proxy networks, and account clustering.
You can apply the same idea to your own keys. Every key should have an expected caller, volume, and time of day. A key that normally runs a nightly CI job and suddenly makes 40,000 calls at 3 a.m. from a new region is either compromised or being distilled. Put rate limits per key, alert on deviation, and rotate on suspicion rather than proof. Audit logs on your API tooling close the loop by showing who exported what, when.
The pattern under all seven
Every case in the report has an ordinary mechanism underneath: a leaked key, an untrusted intermediary, secrets in plaintext, unreviewed output, unmonitored usage. The AI layer didn’t invent those gaps. It raised the price of leaving them open, because attackers now automate the search and buyers now pay for the stolen access.
Four controls answer most of it. Keep keys out of source and prompts. Buy from vendors you can name. Test the contract, including which model answers. Put a human between agent output and production. We made the same argument after the Vercel breach, and this report proves it at a scale nobody can wave away.
Download Apidog and start small: move every hardcoded key in your collections into a masked environment variable, then add one assertion on $.model to every request that goes through a third party. Two hours of work, and two of the report’s attack paths stop applying to you.
FAQ
What is model distillation, and why does Anthropic call it illicit? Distillation trains a smaller or cheaper model on the outputs of a larger one. On your own models it’s standard practice. Anthropic’s complaint is that rival labs used thousands of fraudulent accounts to extract Claude’s reasoning against its terms, in two cases by routing their own customers’ traffic through Claude without disclosure.
Did Anthropic get hacked? Not according to the report. It states that in every cyber case the API keys were stolen from customers’ environments and “Anthropic’s own systems were not compromised.”
How do I know if a third-party AI API is sending my requests to the model it claims? Test it. Compare the model field, token usage on identical prompts, provider-specific headers and signed blocks, and latency against the vendor’s official endpoint. A scheduled test scenario keeps it honest over time.
Is it safe to use Kimi, DeepSeek, or Qwen APIs after this? The report makes claims about the labs’ training practices and, for two of them, about undisclosed request forwarding. It doesn’t change how you should treat any third-party API: keep secrets out of prompts, know who holds your traffic, and verify the contract. That standard applies to every vendor, including US ones.
Can Apidog stop my keys from being stolen? No tool can promise that. Apidog reduces the places a key can leak from: masked environment and vault-backed variables, Secret Scanner on the Enterprise plan, and audit logs. The rest is process.
Where does Sharkly fit if I already use Claude Code? Alongside it. Claude Code does the execution. Sharkly manages the work around it: assignment, isolated worktrees, progress, and the human review step before anything ships. It’s provider neutral, so the workflow survives when the best agent changes.
