Active Scanning for Exposed Anthropic API Endpoints
Active Scanning for Exposed Anthropic API Endpoints (TL-2026-0051), also tracked as Anthropic API Scanning, is a medium-severity tracked intrusion set scored CVSS 6.5, first published 2026-02-03. It has no confirmed attribution, affects Anthropic Claude API / Self-hosted instances, maps to 35 MITRE ATT&CK techniques (T1020, T1036, T1059), and is covered by 14 detection rules and 44 indicators of compromise.
Key facts for TL-2026-0051
- Threat ID
- TL-2026-0051
- Also known as
- Anthropic API Scanning, LLM Endpoint Hunting
- Severity
- MEDIUM
- CVSS
- 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
- Status
- MONITORING
- Category
- THREAT_INTEL
- First published
- 2026-02-03
- Last reviewed
- 2026-02-03
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- Technology, Software Development, AI/ML Industry, SaaS Providers, Research and Education, Financial Services, Healthcare
- Target regions
- Global, United States, India, Brazil, China, Europe
- Detection rules
- 14
- Indicators of compromise
- 44
Active internet-wide scanning campaigns target exposed Anthropic Claude API keys and endpoints, enabling LLMjacking (stolen AI inference at victim expense), data exfiltration through compromised model contexts, and abuse of paid API quotas for malicious content generation. GitGuardian's 2024 State of Secrets Sprawl report documented a 1212x increase in GenAI API key leaks on GitHub from 2022 to 2023, with Anthropic Claude keys showing 'rapid penetration' alongside OpenAI, Gemini, and HuggingFace tokens. API keys leak through public GitHub commits, .env files in Docker images, client-side JavaScript, CI/CD logs, stack traces, and shared notebooks. Automated scanners (GitHub dorking bots, Shodan, Censys) discover leaked keys within minutes of commit. Stolen keys are monetized through underground LLMjacking-as-a-service at 80-95% discount versus legitimate API pricing.
How Active Scanning for Exposed Anthropic API Endpoints works
The AI API Key Exposure Crisis — Anthropic Claude as Primary Target:
Anthropically-priced AI API keys are among the most valuable credentials leaked in public repositories. A single Anthropic API key with Opus-tier access can generate $10,000+/month in inference costs if abused. Unlike traditional cloud credentials (AWS, GCP) that have mature secret scanning ecosystems, AI API keys are a newer credential class with immature detection and rotation practices.
How Anthropic API Keys Leak:
1. Public GitHub Commits (Primary Vector — 60%+): - Developer hardcodes `ANTHROPIC_API_KEY=sk-ant-api03-...` in source code - Commits to public repository (accidentally or through fork/mirror misconfiguration) - GitGuardian detected 12.8M secrets in GitHub commits in 2023 — AI keys are fastest-growing category - Even if commit is reverted, key is in git history permanently - GitHub dorking queries: `sk-ant-api` or `ANTHROPIC_API_KEY` return thousands of results - Automated bots scan new GitHub commits in real-time, extracting API keys within seconds of push
2. Docker Images and Container Registries (15%): - .env files baked into Docker images during build - `docker history` or image layer inspection reveals embedded credentials - Public Docker Hub, AWS ECR, GCP Artifact Registry exposures - docker-compose.yml with inline environment variables pushed to public repos
3. Client-Side JavaScript and Mobile Apps (10%): - API keys embedded in frontend JavaScript (React, Vue, Angular) - Browser DevTools network tab reveals API calls with Authorization headers - Mobile app decompilation (APK/IPA) extracts hardcoded keys - 'Proxy through backend' is the correct pattern — direct client→API calls expose keys
4. CI/CD Pipeline Logs and Artifacts (8%): - Build logs printing environment variables containing API keys - GitHub Actions artifacts with .env files - Jenkins/GitLab CI output logs accessible without authentication - Terraform state files containing API keys in plaintext
5. Shared Notebooks and Documentation (5%): - Jupyter notebooks with API keys in cells committed to GitHub - README files with example code containing real (not placeholder) keys - Confluence/Notion documentation with embedded credentials - Tutorial blog posts with live API keys in code samples
6. Stack Traces and Error Messages (2%): - Application errors exposing API keys in stack traces - Sentry, Datadog, and logging services capturing keys in error context - API keys appearing in URL query parameters logged by web servers
What Attackers Do with Stolen Anthropic API Keys:
1. LLMjacking — Stolen Inference ($0.01-$0.10 vs $0.015/1K tokens): - Run inference through victim's API key at zero cost - Generate spam, phishing emails, malware code, social engineering scripts - Solve CAPTCHAs, generate SEO content, produce academic cheating material - Underground pricing: $0.01-$0.10 per 1K tokens (vs Anthropic's $0.015-$0.075) - Monthly bills: victims discover $5K-$50K charges on compromised keys
2. Data Exfiltration via Conversation Context: - If API key is used with system prompts containing proprietary context (RAG systems, internal docs) - Attacker queries the same endpoint and receives responses grounded in victim's private data - Particularly dangerous for API keys used in production RAG pipelines with database context
3. Abuse Quota Exhaustion: - Attacker exhausts rate limits and token budgets, causing denial of service for legitimate use - Rate limit exhaustion prevents the victim's production systems from functioning - API providers may suspend the account for abuse, affecting legitimate operations
4. Credential Chain Exploitation: - API keys often coexist with other credentials in .env files - Attacker finds ANTHROPIC_API_KEY alongside DATABASE_URL, AWS_SECRET_ACCESS_KEY, STRIPE_SECRET_KEY - Single .env file leak → multiple service compromises - The API key is the entry point; the .env file is the treasure trove
Scanning Infrastructure and Timeline:
- Automated GitHub dorking bots scan new commits in real-time - Key from commit to exploitation: median 11 minutes (source: GitGuardian) - Shodan/Censys scan for exposed API proxy endpoints - Dedicated Telegram channels share newly discovered API keys - Underground markets sell 'verified' API keys with remaining quota information - Key rotation: median time to rotate a leaked key = 12+ days (most never rotated)
Anthropic-Specific Key Format and Detection: - API key format: `sk-ant-api03-*` (64+ character alphanumeric string) - Previous formats: `sk-ant-api02-*`, `sk-ant-*` - API endpoint: `https://api.anthropic.com/v1/messages` - Header: `x-api-key: sk-ant-api03-...` or `Authorization: Bearer sk-ant-...` - Model parameter: `claude-opus-4-20250514`, `claude-sonnet-4-20250514`, etc.
Economic Scale: - GitGuardian: 12.8M secrets detected on GitHub in 2023 (1.8M unique) - AI API keys: fastest growing category — 1212x increase for OpenAI, similar trajectory for Anthropic - Average cost per compromised AI API key: $5K-$50K in fraudulent inference charges - Underground LLMjacking market: estimated $10M-$50M annually across all AI providers - Anthropic's pricing (Claude Opus): $15/$75 per MTok input/output — premium target for jacking
MITRE ATT&CK techniques used in TL-2026-0051
exfiltration
T1020 Automated Exfiltration; T1567 Exfiltration Over Web Service
defense-evasion
T1036 Masquerading; T1078 Valid Accounts; T1535 Unused/Unsupported Cloud Regions; T1550 Use Alternate Authentication Material
execution
T1059 Command and Scripting Interpreter
command-and-control
T1071 Application Layer Protocol; T1102 Web Service
discovery
T1087 Account Discovery; T1526 Cloud Service Discovery; T1538 Cloud Service Dashboard
persistence
collection
T1119 Automated Collection; T1213 Data from Information Repositories; T1530 Data from Cloud Storage
initial-access
T1190 Exploit Public-Facing Application; T1566 Phishing
impact
T1496 Resource Hijacking; T1499 Endpoint Denial of Service; T1531 Account Access Removal; T1657 Financial Theft
credential-access
T1528 Steal Application Access Token; T1552 Unsecured Credentials
resource-development
T1586 Compromise Accounts; T1587 Develop Capabilities; T1588 Obtain Capabilities; T1608 Stage Capabilities
reconnaissance
T1589 Gather Victim Identity Information; T1591 Gather Victim Org Information; T1593 Search Open Websites/Domains; T1595 Active Scanning; T1595.002 Vulnerability Scanning; T1596 Search Open Technical Databases
defense-impairment
Affected products and versions in Active Scanning for Exposed Anthropic API Endpoints
- Anthropic — Claude API / Self-hosted instances
Vulnerable versions: Exposed instances without authentication
Fixed in: Properly secured deployments
Remediation for Active Scanning for Exposed Anthropic API Endpoints
Patches
- N/A — credential management issue, not a software vulnerability
Immediate actions
- Scan ALL repositories for exposed API keys using TruffleHog, GitGuardian, or GitHub secret scanning
- Rotate ANY Anthropic API key that has ever been committed to a repository — even if the commit was reverted, the key is in git history
- Enable Anthropic API key usage alerts and billing limits to detect LLMjacking abuse
- Remove API keys from client-side code — proxy all AI API calls through an authenticated backend
- Audit .env files in Docker images: run 'docker history' on all published images to check for embedded secrets
Workarounds
- Use environment variable injection at runtime (not build time) for all API keys
- Implement API key scoping: separate keys for development, staging, production with different quotas
- Use short-lived API tokens where supported instead of long-lived API keys
- Monitor Anthropic billing dashboard daily for unexpected usage spikes
Longer-term hardening
- Implement secret management vault (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault) for all API keys
- Deploy pre-commit hooks (TruffleHog, GitGuardian, detect-secrets) to prevent API key commits
- Implement API key rotation policy: 90-day maximum lifetime, immediate rotation on suspected compromise
- Enable GitHub push protection (blocks commits containing detected secrets before they reach the repo)
- Implement per-key usage quotas and IP allowlists on Anthropic API keys
- Deploy API gateway/proxy between applications and AI APIs — centralize key management and add rate limiting
Weaknesses (CWE) in Active Scanning for Exposed Anthropic API Endpoints
CWE-306, CWE-200
Timeline of Active Scanning for Exposed Anthropic API Endpoints
- OpenAI launches ChatGPT. Massive developer adoption of AI APIs begins. API key management practices lag behind adoption speed. First wave of OpenAI API key leaks on GitHub.
- Anthropic launches Claude API for public access. Developer adoption accelerates. API keys begin appearing in public GitHub repositories within weeks. Key format: sk-ant-api02-*.
- GitGuardian reports GenAI API key leaks surging on GitHub. OpenAI keys: 1212x increase from 2022. Anthropic, Gemini, HuggingFace, Cohere keys growing rapidly. AI keys become fastest-growing leaked secret category.
- GitGuardian 2023 year-end data: 12.8M secrets detected on GitHub, 8M commits with at least one secret. 1 in 10 commit authors leaked a secret. India, US, Brazil lead leak counts. Source: https://www.gitguardian.com/state-of-secrets-sprawl-report-2024
- GitGuardian publishes State of Secrets Sprawl 2024 report. Highlights 1212x increase in OpenAI key leaks. Anthropic/Claude identified as 'rapid penetration' in leak data. AI service adoption measurable through leak volume trends.
- Wiz and Sysdig publish LLMjacking research: attackers using stolen API keys and cloud credentials for free AI inference. Establishes economic model: underground AI inference at $0.01-$0.10/1K tokens vs $0.015-$0.075 legitimate. Source: https://sysdig.com/blog/llmjacking-stolen-cloud-credentials-used-in-new-ai-attack/
- GitHub expands push protection to detect and block AI API key commits before they reach repositories. Supports OpenAI, Anthropic, and other AI provider key patterns. Adoption slow — many developers disable to unblock pushes.
- Automated GitHub dorking bots scanning new commits in real-time for AI API keys. Median time from commit to exploitation: 11 minutes. Dedicated Telegram channels share discovered keys within minutes.
- Anthropic migrates to sk-ant-api03-* key format. New format does not include built-in expiry. Keys remain valid indefinitely unless manually rotated. Legacy sk-ant-api02-* keys still accepted.
- Claude Opus pricing: $15/$75 per million tokens input/output. Premium pricing makes Anthropic keys among the most valuable targets for LLMjacking — higher per-token cost = higher abuse value.
- Docker image secret leaks become major vector. Developers bake .env files into Docker images during build. Public images on Docker Hub contain Anthropic, OpenAI, AWS, and database credentials. docker history command reveals embedded secrets.
- LLMjacking-as-a-service market matures on Telegram and dark web. Stolen API keys sold with remaining quota information. Pricing: $0.01-$0.10/1K tokens (80-95% discount). Monthly jacking revenue estimated $10M-$50M across all AI providers.
- Credential chain exploitation pattern documented: leaked .env file contains ANTHROPIC_API_KEY + DATABASE_URL + AWS_SECRET_ACCESS_KEY + STRIPE_SECRET_KEY. Single file leak enables multi-service compromise. API key is the canary; .env file is the breach.
- Active scanning campaigns for Anthropic API endpoints intensify. Scanners target: GitHub commits (real-time), public Docker images, Terraform state files, Jupyter notebooks, Pastebin/Ghostbin, and CI/CD build logs.
- Key rotation analysis: median time to rotate a leaked AI API key = 12+ days. Most leaked keys are never rotated. Anthropic keys have no built-in expiry — a key leaked in 2023 may still be valid and abusable in 2026.
- Threadlinqs Intelligence analysis: Anthropic API key exposure represents the credential management failure of the AI era. 1212x increase in GenAI key leaks, 11-minute median exploitation time, and no built-in key expiry create a persistent, growing attack surface. The API key IS the perimeter — when it leaks, the perimeter is gone.
- As of 2026-05-29, this LLMjacking/Anthropic API-key scanning threat remains active and intensifying: GitGuardian's State of Secrets Sprawl 2026 reports 28.65M GitHub secrets leaked in 2025 (+34% YoY) and AI-service keys +81% YoY, with active validation/resale ops (Operation Bizarre Bazaar, silver.inc) still running. It is a credential-exposure class with no CVE to patch; Microsoft's Storm-2139 action curbed one syndicate but not the phenomenon, so MONITORING holds.
Sources cited for Active Scanning for Exposed Anthropic API Endpoints
- SANS ISC Diary: Scanning for Anthropic API Endpoints
- GitGuardian — State of Secrets Sprawl Report 2024: 12.8M Secrets on GitHub
- Sysdig — LLMjacking: Stolen Cloud Credentials Used for AI Inference
- Wiz Research — LLMjacking: Stolen Compute for AI Model Abuse
- Anthropic — API Key Management and Security Best Practices
- GitHub — Secret Scanning: Detecting Leaked API Keys in Commits
- Truffle Security — TruffleHog: API Key and Secret Detection Tool
- OWASP — Secrets Management Cheat Sheet
- GitGuardian — GenAI API Key Leaks: 1212x Increase in OpenAI Key Exposure
- Anthropic — Usage and Billing: Rate Limits and Quota Management
- NIST SP 800-63B — Digital Identity Guidelines: Authentication and Lifecycle Management
- Anthropic — API Documentation
Threats related to Active Scanning for Exposed Anthropic API Endpoints
Detection coverage for TL-2026-0051
As of 2026-02-03, Threadlinqs Intelligence publishes 14 detection rule(s) for TL-2026-0051 across Splunk SPL, Microsoft KQL and Sigma, covering 44 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.