It sounds absurd: someone breaks into your system, and instead of emptying your database, they start making you pay for their AI.But that is increasingly the point.A stolen AI credential can give an attacker more than access to a company. It can give them computing power that the company has already paid for.Attackers are increasingly stealing API keys, login sessions and other credentials that provide access to AI services, using them to run their own workloads, resell the access or hide behind legitimate customer accounts. The target is no longer necessarily the data sitting inside an organisation. In some cases, it is the AI access itself.Anthropic’s September 2026 threat report describes an emerging criminal economy built around stolen AI access. Attackers are harvesting credentials from code repositories, mobile applications, websites, Docker containers, chatbots and other places where companies accidentally expose them. Those credentials can then be resold, used in further attacks, or simply used to run AI workloads at the legitimate customer’s expense.The economics are simple: one stolen key can deliver three things – loot, compute and cover.
- Loot – because
stolen AI credentials can be resold. - Compute – because someone else can foot the bill for the workload.
- Cover – because the activity can look like it is coming from a legitimate customer.
CrowdStrike’s 2026 Threat Hunting Report has observed a similar shift. In one campaign, attackers abusing corporate AI access generated nearly 200,000 API requests in an initial two-minute flood, using the victim’s AI resources rather than simply stealing information from the account.
A stolen AI key can give attackers more than access — it can give them computing power.
AI access is becoming something criminals can sell
An API key is a string of characters that works like a digital pass. It allows an application to use an online service without a person having to log in each time. When linked to an AI service, that key can allow software to send requests to an AI model.A session token serves a similar purpose. It is a digital proof that a user has already logged in and can allow continued access to an account.If criminals steal either, they may not need the victim’s password. They may be able to use the existing access instead.Anand Venkatraman, Partner, Deloitte India, said this represents a change in how stolen credentials are viewed.“API keys and session tokens have emerged as a new class of high-value digital assets. Historically, stolen credentials were a means to access networks, applications, or data. Today, the credential itself is often the target.”The reason is simple. A working AI credential can already have an economic value.“A live API key linked to a funded enterprise AI account is a monetizable asset that can be resold or abused directly, much like cloud credentials became valuable commodities once cloud compute gained economic value,” Venkatraman said.In other words, criminals do not necessarily need to steal what an AI service has generated. They can steal the ability to use the service in the first place.Anthropic says one hacktivist campaign ran for an entire month using stolen API keys. In another case, suspected ShinyHunters affiliates stole AI keys during an intrusion and switched their own attack workloads onto those keys.The theft is also becoming industrialised.One criminal pipeline downloaded 1.8 million Android APKs, decompiled them and searched them for hardcoded secrets. A separate harvesting operation collected GitHub personal access tokens. The stolen credentials were then validated and fed into criminal operations.Another group went after users themselves by pretending to sell cheap access to frontier AI models. Victims who installed what appeared to be AI software instead handed over credentials and authenticated session tokens. The stolen access was then sold onward to other AI resellers.And the target is not limited to ordinary AI users.
From exposed keys to underground brokers, stolen AI access can pass through several hands.
Criminals can make the victim pay for their AI use
AI services are generally paid for based on usage. The more a customer uses a model, the more computing resources are consumed and, depending on the service, the larger the bill can become.This creates an opportunity for attackers.They can take a stolen credential and use the victim’s account to run their own AI workloads. This is sometimes referred to as LLMJacking, where criminals hijack access to an AI model and use the victim’s computing resources.CrowdStrike said it observed financially motivated criminals abusing corporate large language model, or LLM, access for LLMJacking and cost harvesting. In one campaign, attackers sent nearly 200,000 API requests in an initial two-minute flood.CrowdStrike describes cloud resource hijacking as the unauthorised use of a victim’s computing resources after an account is compromised. The same approach can be used for cryptocurrency mining or AI workloads, with the victim effectively providing the computing power and paying the associated cost.Venkatraman said the economics are similar to earlier forms of cybercrime.“The move from data theft to access theft reflects a natural evolution of cybercrime. Underground markets have progressed from selling VPN and RDP access to cloud credentials, and now AI platform access.”The attraction is that a stolen AI account may already have a payment method, an established usage history and access to models that could otherwise be expensive to use.
A legitimate account can also provide cover
There is another advantage for criminals. Activity carried out using a legitimate customer’s account can be harder to distinguish from normal usage.“A stolen AI credential isn’t just reusable, it’s a paid-for gateway: the attacker inherits legitimate compute quota and model access under someone else’s billing and identity, making the activity far harder to flag than a conventional stolen password,” said Saurabh Sharma, security researcher, Global Research and Analysis Team (GReAT), Kaspersky.
Hackers are increasingly treating AI credentials as digital assets that can be harvested and resold.
Venkatraman identified three reasons stolen AI credentials are attractive: they can be resold, they provide access to paid computing resources and they allow criminals to operate through a legitimate customer’s account.This means an attacker does not always have to create a new account or find a way to pay for AI services. The victim’s existing access can do that work.
Developers are leaving credentials in places criminals can search
The growing value of AI credentials is also changing what criminals look for when searching the internet.Anthropic said attackers have been searching public code repositories, mobile applications, container images and websites for API keys and session tokens. In one case documented by the company, an attacker stole AI API keys from an enterprise software vendor and subsequently used one of those keys for secondary attacks against other organisations.The problem often starts with something as straightforward as a developer accidentally leaving a key inside software code.Venkatraman said common sources include “Hardcoded keys committed to repositories and exposed through forks or misconfigured CI/CD pipelines”, credentials embedded inside mobile applications, secrets included in container images and tokens exposed through client-side JavaScript.A container image is essentially a packaged version of software that can be moved between computers or cloud services. If a secret is accidentally included in that package, anyone who obtains it may also obtain the credential.Kaspersky has seen similar activity in developer tools. Sharma cited the 2025 singularity incident, in which attackers stole a package-publishing token and used it to push malicious npm packages designed to steal secrets from Claude Code, Gemini CLI and Amazon Q CLI.
AI access is becoming a new target as attackers seek keys, accounts, compute and billing access.
CrowdStrike also found attackers targeting software development environments, package registries and container registries. It said npm accounted for 87% of malicious software registry threats in the first half of 2026.
AI is adding more links to the supply chain
The term AI supply chain can sound abstract, but the idea is relatively simple. Companies increasingly connect AI services to their software, customer support systems, internal databases and automated assistants. Each connection needs some form of permission or credential.That creates more places where access can be exposed or stolen.AI agents are making this network wider. An AI agent is software that can carry out tasks on behalf of a user, rather than simply responding to a question. Such agents can be connected to email, messaging, calendars, company databases and other services.Sharma said this is creating more potential routes into an organisation.“Absolutely every new integration point is a new credential to protect. We’ve flagged that AI agents are frequently connected to email, messaging, task-management systems, knowledge bases and MCP servers, meaning a malicious instruction or a credential leak can now originate from virtually any source the agent processes automatically.”For companies, that means protecting an AI system is no longer only about securing the model itself. The credentials that connect the model to other services can become targets too.Venkatraman said this is particularly relevant for Indian enterprises because AI deployments can also create new compliance responsibilities.“This trend resembles the evolution from “shadow IT” to “shadow cloud” and now “shadow AI.” For Indian enterprises, governance challenges are amplified by requirements such as RBI outsourcing guidelines, CERT-In incident reporting obligations, and the DPDP framework.”He said organisations should treat AI credentials with the same level of care as other privileged access, including limiting what each credential can do, regularly replacing credentials, monitoring their use and including them in incident response plans.
