Who else is using your AI key?

iPrompt

THE AI NEWSLETTER THAT TURNS NEWS INTO ACTION

ISSUE #153 WEDNESDAY · 16 SEPTEMBER 2026

A hacktivist campaign in Anthropic’s new threat report ran for a month on stolen AI keys. The victims supplied the compute, paid the bill and lent their account identities to the activity. The practical question is closer to home: where could someone find a copy of your key?

OUR ANGLE

Your key is access someone can sell

Anthropic describes groups harvesting credentials from public code, mobile apps, container images and chatbots, then testing and reselling them. An AI key is a reusable access credential. What it can spend, read or change depends on its permissions. Treating it as a billing detail misses much of the risk.

Anthropic threat report · 10 September

One reseller advertised discounted Claude access, quietly substituted another model and harvested customers’ Anthropic credentials. As Claude Code’s summer allowance ends, cheaper routes may look more attractive. That does not make every gateway suspect. It makes the identity of the operator, and the access you hand over, part of the buying decision.

Weigh the source: Anthropic benefits when customers buy direct. Its report documents selected cases, not the odds that your team will be hit. Our conclusion is narrower: treat AI keys like production passwords, with a named owner and a clear purpose. Start by auditing one place they might have been copied.

COMPANION DEEP DIVE · AI API key security
Start with the five-step audit, then use the leak-location checklist and response guidance. The prediction ledger is a separate appendix.

AI NEWS ROUNDUP

What changed around your access

1 Claude Code’s weekly allowance fell. From 14 September, eligible Pro, Max, Team and seat-based Enterprise limits are 25% above their pre-promotion baseline, down from 50% above it. That is a 16.7% reduction from the summer allowance, not a 25% cut. Five-hour limits are unchanged.

Anthropic help centre · limits update

2 OpenAI separates agent access from the secret. The Agents API entered public beta on 10 September. Its vaults let agents use supported MCP credentials without receiving the raw secret. That reduces one exposure route; it does not remove the need to restrict permissions or revoke tokens at their provider. The beta supports US data residency only and no Zero Data Retention.

OpenAI launch · 10 September · Agents API docs

3 An old image still held a live admin token. Strix says a token in a March 2023 Baseten image still worked in July 2026. Baseten restricted the registry and rotated the token the next day. This is a vendor case study: Strix sells the agent that found it. The useful lesson is to inspect image history as well as files.

Strix write-up · September

THE THREE SPECIALS / DO · USE · UNDERSTAND

PROMPT OF THE WEEK

An inventory for one location

Choose one repository, image or automation account. Use names and redacted metadata only. Give this prompt to your assistant or the person who manages your integrations.

Help me audit AI-related credentials in ONE location and produce a short action list. Work from descriptions and redacted metadata only.

LOCATION: [one repo, image or automation account]
SERVICES AND OWNER: [providers, workflows, responsible person]
KNOWN CONTROLS: [permissions, expiry, enforced limits, alerts]

Never request or repeat a secret. If I paste one, stop and tell me to treat it as exposed. Do not claim you have scanned anything or verified a control without evidence.

1. Ask up to three questions needed to define the scope and dependencies.

2. Make a table: key label, owner, purpose, possible copies, permissions, last use and evidence. Mark missing information unknown.

3. Prioritise confirmed exposure or suspicious use, then credentials with the widest access. State what remains unverified.

4. For each finding, assign an owner and next step. Distinguish urgent revocation for exposed keys from planned rotation of keys with no evidence of compromise.

5. Finish with a redacted summary: location checked, findings, action taken and unresolved questions. Keep it under 100 words.

Why it works: a defined scope produces a finishable audit. Unknowns stay visible instead of being mistaken for reassurance.

TOOL OF THE WEEK

TruffleHog

TruffleHog is a free, open-source secret scanner. It searches repositories and other sources, including Docker images, and can test detected credentials with their providers. From inside a local repository you own, start with:

trufflehog git file://. --results=verified,unknown,unverified

Verification contacts providers. Scan only authorised material and keep output private because it can contain secrets. Investigate unknown and unverified findings too; a scan with no findings is not proof of safety. For containers, inspect build history separately.

TruffleHog on GitHub

TIP OF THE WEEK

Deleting a copy does not revoke access

A key removed from today’s code can survive in yesterday’s commit or image. OpenAI’s vault documentation makes the same distinction: deleting a stored credential does not revoke it at the provider or stop a running session.

If a key is publicly exposed or being abused, revoke or disable it promptly, even if a workflow pauses. If there is no evidence of compromise, planned rotation can replace, update and test before revocation. The deep dive explains both paths, including what to do if the device itself is compromised.

OpenAI vaults documentation

YOUR MOVE

Audit one location this week

Choose one repository, container image or automation account and complete a first pass using the companion audit. If someone else runs your systems, ask them for the result. An unresolved finding counts as a useful outcome; record who will investigate it.

REPLY FORMAT

Old support-bot repo: 3 candidate keys; 1 confirmed live and exposed; revoked; 2 under review.
Illustrative reply only. Never send credentials or raw scanner output.

Reader follow-up: we are closing the #151 CHANGED/SAME and REACHABLE exercises and #152 timing exercise without published results because the counts are unverified. No conclusions are drawn from them.

Disclosure: the original draft used Claude. This issue relies on Anthropic’s report; its commercial interest is noted above.

P.S. A budget alert tells you about spending. Check whether your provider also offers an enforced limit.

iprompt.com

iPROMPT / 153 /