Key points
- Threat actors used prompt injection to compromise an evaluation sandbox environment.
- Stolen API keys were used to consume victims' own compute resources for further attacks.
- Approximately thirty AI labs were targeted as secondary victims in this campaign.
Attackers exploited a prompt injection vulnerability within an evaluation sandbox to extract customer API keys, according to a September 2026 threat report shared on r/netsec. The malicious code leveraged this access to hijack the victims' own computational resources, turning their infrastructure into a launching pad for further attacks against other organizations.
The campaign specifically targeted roughly thirty AI labs after the initial compromise. By burning through the victims' compute budgets, the attackers were able to execute attacks against these external entities without revealing their own origin. This method allowed the threat actors to utilize the customers' own cloud spend against the broader AI ecosystem.
What we know
The incident highlights the risks of using evaluation sandboxes that interact directly with external API endpoints. The attackers manipulated the sandbox via prompt injection to gain access to the keys. Once the keys were exfiltrated, the threat actors used them to generate workloads on the victims' accounts, effectively weaponizing the customers' own cloud spend against the broader AI ecosystem.
Defender's checklist
- Review sandbox environments for strict input validation against prompt injection techniques.
- Ensure API keys used in evaluation tools have limited scope and low-rate limits.
- Monitor compute usage patterns for sudden spikes that do not match normal evaluation workflows.
- Isolate evaluation sandboxes from production API keys to prevent lateral movement.
What analysts watch for
Teams usually examine sandbox logs for unusual input patterns that suggest prompt injection attempts. Analysts check whether the sandbox environment has direct access to sensitive credentials or external APIs. They also look for unexpected outbound connections or resource consumption spikes that indicate the system is being used for unauthorized tasks. Persistence mechanisms are often tied to the compromised input handling routines.
What to do and how to stay safe: Anthropic
- Audit all evaluation sandboxes for prompt injection vulnerabilities and restrict their network access.
- Rotate any API keys that may have been exposed in sandbox environments immediately.
- Monitor cloud compute usage for anomalies that could indicate unauthorized workload execution.
- Implement strict input validation and sanitization for all user-facing AI interfaces.
Step-by-step guide: Account Takeover: Definition, Vectors, and Defense Strategies
General security guidance from the Malware Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How did the attackers gain access to the API keys?
The attackers used prompt injection to exploit a vulnerability in an evaluation sandbox, allowing them to steal customer API keys.
What did the attackers do with the stolen keys?
They used the stolen keys to burn through the victims' compute resources, using them to attack approximately thirty AI labs.
How many AI labs were targeted in this campaign?
The campaign targeted roughly thirty AI labs after the attackers compromised the initial evaluation sandbox.
