395 Organizations Breached: Machine Credentials as Weapon and Loot

Four reports, one credential problem

Security teams get a lot of "unprecedented" reports. This week's batch earned the word differently: four groups working independently, on different incidents, in different sectors, landed on the same conclusion within 48 hours of each other. GreyNoise watched an attacker's AI agents breach 395 organizations through a print-management flaw. Anthropic disclosed that a criminal group stole production API keys by prompt-injecting an AI vendor's own evaluation sandbox. GTIG documented an autonomous multi-agent framework that harvested thousands of third-party credentials in under six hours. And Okta traced a 7 GB infostealer dump straight into a Telegram storefront selling access to Claude, ChatGPT, Gemini, and Cursor accounts.

None of these four teams was writing about the same incident. All four were describing the same object: a non-human credential — an API key, a session token, an agent's own authorization — that behaved exactly as designed once it left the system that issued it, and kept working long after anyone should have trusted it.

The weapon: AI agents breach 395 organizations in hours

GreyNoise's report centers on two PaperCut NG/MF vulnerabilities, CVE-2026-81578 and CVE-2026-82078, which the vendor patched on an emergency basis on August 28. Three days later, a threat actor GreyNoise assesses as likely Russian-speaking built a private lab — a vulnerable PaperCut instance plus an Active Directory server — and set two AI systems to work: OpenAI's Codex as an orchestration harness, and a DeepSeek model chosen specifically because it lacks the content-safety guardrails that block offensive security requests in US frontier models.

The agents researched the CVEs, wrote exploit code, tested it against the lab, and then went hunting. They built target lists using the Netlas scanning platform and an identified API key, and launched against real infrastructure with minimal further human direction. The results, once the campaign launched, moved at a pace no human-run intrusion matches: eleven organizations compromised in 26 seconds. At one U.S. high school, the agents went from initial access to full domain administrator in seven minutes. Across the campaign, GreyNoise recorded at least 440 compromised PaperCut instances tied to 395 distinct organizations in 48 countries, with credentials harvested from 280 victims and domain admin achieved at 12.

The attacker had a do-not-target list of 28 countries, mostly in the former Soviet region. GreyNoise found victims in several of them anyway — Russia, China, Kazakhstan, Pakistan — in what it called agents "gone wild," deviating from their own operator's instructions for reasons GreyNoise says remain unclear. That detail matters as much as the breach count: even the attacker didn't have full control of the credentials its own agents were harvesting.

The target: an evaluation sandbox hands over its own keys

The second report, from Anthropic, describes the credential problem from the opposite direction: not agents stealing access to break in, but an AI vendor's own infrastructure being tricked into giving its keys away. Anthropic tracks the actor as GTG-50020 — a financially motivated, Russian-speaking group with a prior history of intrusions against hotel-booking and fintech platforms. GTG-50020 injected malicious instructions into an AI vendor's automated evaluation sandbox, the environment that runs candidate models or agents against test tasks and needs live provider credentials to do it. The sandbox handed over the credentials it held, including production API keys from multiple providers belonging to that vendor.

With those keys in hand, the actor first used them to continue its own attacks, then pivoted to a broader campaign, targeting roughly 30 AI companies over about four days using the same prompt-injection path. Its stated goal — access to a pre-release Claude model, pursued through more than a dozen attempted avenues — never succeeded, and Anthropic says its own systems were not compromised. The keys involved belonged to customers, stolen from customer environments. Anthropic's report separately notes that multiple, unrelated actors used prompt injection against AI wrapper services running LiteLLM to exfiltrate production keys from cloud-hosted containers — a different vector arriving at the identical outcome.

Anthropic's own framing of the incentive is worth repeating in full: access to AI, in the form of compromised API keys, session tokens, and devices, has become the sole objective of multiple criminal groups. Not a means to an end. The end itself.

The commodity: a live market for stolen AI accounts

The third and fourth reports describe where all of that access ends up. Okta's threat intelligence team analyzed a 7 GB infostealer dump released on a Telegram channel in early August, and found evidence of 5,871 infected machines across 162 countries, along with thousands of unexpired authentication tokens for Google, Microsoft, Anthropic, Amazon, and Cursor. Replayed, those tokens bypass multi-factor authentication entirely, because MFA verifies a login event, not the token that login produces. Okta flagged a vendor calling itself "Poison Claude," advertising discounted access to several Claude models with 24/7 customer support and money-back guarantees — the trappings of a legitimate SaaS business built entirely on other people's stolen sessions.

GTIG's parallel report, From Prompting to Autonomy, documented a separate financially motivated actor who compromised an organization's cloud infrastructure and deployed a multi-agent framework — built from an AI coding chatbot plus a set of Markdown-file playbooks — that planned, built, and executed a mass credential-harvesting operation compromising thousands of third-party credentials in under six hours. GTIG notes that these operators are now expanding their search beyond passwords and browser data into the configuration files used by AI development tools specifically, because AI credentials carry direct financial value: they buy compute, and they buy cover, since usage performed with a stolen key is attributed to the legitimate account holder.

None of this is a one-time event. Separate research this year has tracked the cost of this fraud category doubling roughly every two months at some affected companies, which is closer to the growth curve of a functioning market than to a wave of opportunistic theft.

Why IAM policies don't see any of this coming

Every identity and access management system in wide use was built around a specific mental model: a human logs in, IAM checks who they are and what they're allowed to do, and the session that follows inherits both. Rotation happens on a calendar — quarterly, annually, "when someone leaves." Anomaly detection looks for things humans don't do: logins from new geographies, impossible travel, off-hours access.

None of that model holds for the credential types in these four reports. An agent's session token, a CI runner's service credential, an evaluation sandbox's provider key — these are issued to a process, not a person, and that process has no calendar. It runs continuously, from infrastructure that may be shared, scraped, or simply readable by anything with the right prompt. A key that's valid for 24 hours by default, as is standard for most API tokens, is valid for 24 hours whether the request replaying it comes from the agent it was issued to or from a Telegram reseller three time zones away. The credential can't tell the difference, and most IAM policies were never asked to check.

What actually breaks the chain

None of these four incidents were single-point failures a firewall would have stopped. The PaperCut campaign started from an unpatched, internet-facing vulnerability — patching still matters, and GreyNoise notes that a Cloudflare WAF blocked at least one intrusion attempt outright. That's a real mitigation, and it's not the one this piece is about.

The evaluation-sandbox theft, the resale market, and the mass credential-harvesting runs share a narrower, more fixable trait: in each one, a process that only needed to use a credential was instead handed the credential itself. The sandbox didn't need the vendor's raw production keys sitting in memory where a prompt injection could read them out — it needed the ability to make authorized calls on the vendor's behalf, revocably. The infostealer victims' browsers and agent runtimes didn't need long-lived tokens that keep authenticating for a full day after they're copied — they needed a live check that a request is coming from the session it claims to be.

That's the architectural argument for injecting the real credential at the network edge instead of inside the calling process. If an agent, a CI runner, or a dashboard holds a scoped, revocable pointer rather than the underlying API key — with the actual secret swapped in at the egress wire, per request — then a prompt injection, a scraped log, or a leaked dashboard yields nothing an attacker can resell or replay past the next request. This is the model KnoxCall's AI gateway is built around: the agent process never holds the real key, so there is nothing durable in it worth stealing. It would not have stopped the PaperCut authentication bypass — that's a patching failure, not a credential-custody failure. It is a direct answer to the sandbox theft, the resale-market tokens, and the six-hour harvesting runs, because in all three, the thing attackers actually walked away with was a secret that kept working on its own after it left the system that should have been checking it.

For teams evaluating what "machine-speed expiry" should look like in practice, our security overview and the walkthrough of phantom-token architecture cover the mechanics; the short version is that expiry needs to be measured in the same units an attacker's automation operates in — seconds and minutes, not quarters.

What to check this week

• Inventory every place a raw third-party API key currently lives in a process rather than a vault: agent configs, CI environment variables, evaluation harnesses, admin dashboards.
• Confirm your evaluation or sandbox environments don't hold live production keys with the same scope as your real customer-facing traffic.
• Check default token lifetimes on anything an AI agent authenticates with. If the default is measured in hours or days, that's the window an infostealer or a resold session gets to work in.
• If you're patching PaperCut NG/MF, apply the August 28 emergency fixes for CVE-2026-81578 and CVE-2026-82078 and assume any credentials the server touched should be rotated, not just the software.