Active Scanning for Exposed Anthropic API Endpoints

Key facts

Detection coverage

As of 2026-02-03, Threadlinqs Intelligence publishes 14 detection rule(s) for TL-2026-0051 across Splunk SPL, Microsoft KQL and Sigma, covering 44 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Anthropic API Endpoint Scanning Detection

Detects inbound requests probing for Anthropic/Claude API endpoints

• Languages: Splunk SPL, Microsoft KQL
• Data sources: web_logs, proxy, waf
• Severity: high
• Confidence: high

Splunk SPL

index=web sourcetype=access_combined OR index=proxy sourcetype=proxy
| where match(uri_path, "(?i)(/anthropic/v1/|/v1/models|/v1/messages|/v1/complete)")
| where match(http_method, "GET|POST")
| stats count dc(src_ip) as unique_sources values(uri_path) as paths by dest_ip, dest_port
| where count > 5 OR unique_sources > 3
| eval alert_severity="HIGH"
| eval alert_reason="Scanning detected for Anthropic/LLM API endpoints"

Microsoft KQL

// Anthropic API Endpoint Scanning Detection
// Detects probing for exposed LLM API endpoints
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestURL has_any ("/anthropic/v1/", "/v1/models", "/v1/messages", "/v1/complete")
| summarize RequestCount=count(), UniqueSources=dcount(SourceIP), Paths=make_set(RequestURL) by DestinationIP, DestinationPort
| where RequestCount > 5 or UniqueSources > 3

Known false positives:

• Legitimate API health checks from known sources

Tuning notes: Whitelist known API consumers and monitoring systems

• 🔒 Tor Exit Node LLM Scanning · unlock with TL Creds
• 🔒 Docker Image Layer Secret Exposure — Baked-In API Keys in Container Images · unlock with TL Creds
• 🔒 CI/CD Pipeline Log Secret Exposure — API Keys Printed in Build Output · unlock with TL Creds
• 🔒 Credential Chain Detection — Multi-Secret .env File Exposure Assessment · unlock with TL Creds
• 🔒 Pre-Commit Secret Detection Gate — Blocking API Key Commits at Source · unlock with TL Creds
• 🔒 API Key Age and Rotation Policy Violation — Anthropic Key Exceeding 90-Day Lifetime · unlock with TL Creds
• 🔒 Client-Side Anthropic API Call Detection — Frontend Key Exposure via Browser · unlock with TL Creds
• 🔒 Sim Sigma — API Key Leak Detection Pipeline & GitHub Dorking Bot Monitor · unlock with TL Creds
• 🔒 Sim Sigma — AI API Key Exposure Economics & Underground Market Analyzer · unlock with TL Creds
• 🔒 Sim Sigma — Anthropic API Key Leak Scanner & LLMjacking Abuse Detector · unlock with TL Creds
• 🔒 Anthropic API Key Pattern in Source Code Commits — Secret Leak Prevention · unlock with TL Creds
• 🔒 LLMjacking via Stolen Anthropic API Key — Billing Anomaly and Model Upgrade Detection · unlock with TL Creds
• 🔒 Anthropic API Requests from Unauthorized Source IPs — Stolen Key Usage · unlock with TL Creds

Indicators of compromise

As of 2026-02-03, Threadlinqs Intelligence tracks 44 indicators of compromise for TL-2026-0051.

Sample indicators (2 of 44)

• IP address: 204.76.203[.]210
• IP address: 154.83.103[.]179

Defanged, TLP:CLEAR. Full set of 44 indicators: unlock with TL Creds.

Technical analysis

API keys leak through public GitHub commits, .env files in Docker images, client-side JavaScript, CI/CD logs, stack traces, and shared notebooks. Automated scanners (GitHub dorking bots, Shodan, Censys) discover leaked keys within minutes of commit. Stolen keys are monetized through underground LLMjacking-as-a-service at 80-95% discount versus legitimate API pricing.

The AI API Key Exposure Crisis — Anthropic Claude as Primary Target:

Anthropically-priced AI API keys are among the most valuable credentials leaked in public repositories. A single Anthropic API key with Opus-tier access can generate $10,000+/month in inference costs if abused. Unlike traditional cloud credentials (AWS, GCP) that have mature secret scanning ecosystems, AI API keys are a newer credential class with immature detection and rotation practices.

How Anthropic API Keys Leak:

1. Public GitHub Commits (Primary Vector — 60%+): - Developer hardcodes `ANTHROPIC_API_KEY=sk-ant-api03-...` in source code - Commits to public repository (accidentally or through fork/mirror misconfiguration) - GitGuardian detected 12.8M secrets in GitHub commits in 2023 — AI keys are fastest-growing category - Even if commit is reverted, key is in git history permanently - GitHub dorking queries: `sk-ant-api` or `ANTHROPIC_API_KEY` return thousands of results - Automated bots scan new GitHub commits in real-time, extracting API keys within seconds of push

2. Docker Images and Container Registries (15%): - .env files baked into Docker images during build - `docker history` or image layer inspection reveals embedded credentials - Public Docker Hub, AWS ECR, GCP Artifact Registry exposures - docker-compose.yml with inline environment variables pushed to public repos

3. Client-Side JavaScript and Mobile Apps (10%): - API keys embedded in frontend JavaScript (React, Vue, Angular) - Browser DevTools network tab reveals API calls with Authorization headers - Mobile app decompilation (APK/IPA) extracts hardcoded keys - 'Proxy through backend' is the correct pattern — direct client→API calls expose keys

4. CI/CD Pipeline Logs and Artifacts (8%): - Build logs printing environment variables containing API keys - GitHub Actions artifacts with .env files - Jenkins/GitLab CI output logs accessible without authentication - Terraform state files containing API keys in plaintext

5. Shared Notebooks and Documentation (5%): - Jupyter notebooks with API keys in cells committed to GitHub - README files with example code containing real (not placeholder) keys - Confluence/Notion documentation with embedded credentials - Tutorial blog posts with live API keys in code samples

6. Stack Traces and Error Messages (2%): - Application errors exposing API keys in stack traces - Sentry, Datadog, and logging services capturing keys in error context - API keys appearing in URL query parameters logged by web servers

What Attackers Do with Stolen Anthropic API Keys:

1. LLMjacking — Stolen Inference ($0.01-$0.10 vs $0.015/1K tokens): - Run inference through victim's API key at zero cost - Generate spam, phishing emails, malware code, social engineering scripts - Solve CAPTCHAs, generate SEO content, produce academic cheating material - Underground pricing: $0.01-$0.10 per 1K tokens (vs Anthropic's $0.015-$0.075) - Monthly bills: victims discover $5K-$50K charges on compromised keys

2. Data Exfiltration via Conversation Context: - If API key is used with system prompts containing proprietary context (RAG systems, internal docs) - Attacker queries the same endpoint and receives responses grounded in victim's private data - Particularly dangerous for API keys used in production RAG pipelines with database context

3. Abuse Quota Exhaustion: - Attacker exhausts rate limits and token budgets, causing denial of service for legitimate use - Rate limit exhaustion prevents the victim's production systems from functioning - API providers may suspend the account for abuse, affecting legitimate operations

4. Credential Chain Exploitation: - API keys often coexist with other credentials in .env files - Attacker finds ANTHROPIC_API_KEY alongside DATABASE_URL, AWS_SECRET_ACCESS_KEY, STRIPE_SECRET_KEY - Single .env file leak → multiple service compromises - The API key is the entry point; the .env file is the treasure trove

Scanning Infrastructure and Timeline:

- Automated GitHub dorking bots scan new commits in real-time - Key from commit to exploitation: median 11 minutes (source: GitGuardian) - Shodan/Censys scan for exposed API proxy endpoints - Dedicated Telegram channels share newly discovered API keys - Underground markets sell 'verified' API keys with remaining quota information - Key rotation: median time to rotate a leaked key = 12+ days (most never rotated)

Anthropic-Specific Key Format and Detection: - API key format: `sk-ant-api03-*` (64+ character alphanumeric string) - Previous formats: `sk-ant-api02-*`, `sk-ant-*` - API endpoint: `https://api.anthropic.com/v1/messages` - Header: `x-api-key: sk-ant-api03-...` or `Authorization: Bearer sk-ant-...` - Model parameter: `claude-opus-4-20250514`, `claude-sonnet-4-20250514`, etc.

Economic Scale: - GitGuardian: 12.8M secrets detected on GitHub in 2023 (1.8M unique) - AI API keys: fastest growing category — 1212x increase for OpenAI, similar trajectory for Anthropic - Average cost per compromised AI API key: $5K-$50K in fraudulent inference charges - Underground LLMjacking market: estimated $10M-$50M annually across all AI providers - Anthropic's pricing (Claude Opus): $15/$75 per MTok input/output — premium target for jacking

MITRE ATT&CK techniques by tactic:

exfiltration

T1020 Automated Exfiltration; T1567 Exfiltration Over Web Service

defense-evasion

T1036 Masquerading; T1078 Valid Accounts; T1535 Unused/Unsupported Cloud Regions; T1550 Use Alternate Authentication Material

execution

T1059 Command and Scripting Interpreter

command-and-control

T1071 Application Layer Protocol; T1102 Web Service

discovery

T1087 Account Discovery; T1526 Cloud Service Discovery; T1538 Cloud Service Dashboard

persistence

T1098 Account Manipulation

collection

T1119 Automated Collection; T1213 Data from Information Repositories; T1530 Data from Cloud Storage

initial-access

T1190 Exploit Public-Facing Application; T1566 Phishing

impact

T1496 Resource Hijacking; T1499 Endpoint Denial of Service; T1531 Account Access Removal; T1657 Financial Theft

credential-access

T1528 Steal Application Access Token; T1552 Unsecured Credentials

resource-development

T1586 Compromise Accounts; T1587 Develop Capabilities; T1588 Obtain Capabilities; T1608 Stage Capabilities

reconnaissance

T1589 Gather Victim Identity Information; T1591 Gather Victim Org Information; T1593 Search Open Websites/Domains; T1595 Active Scanning; T1595.002 Vulnerability Scanning; T1596 Search Open Technical Databases

defense-impairment

T1685 Disable or Modify Tools

Remediation

Patches

• N/A — credential management issue, not a software vulnerability

Immediate actions

• Scan ALL repositories for exposed API keys using TruffleHog, GitGuardian, or GitHub secret scanning
• Rotate ANY Anthropic API key that has ever been committed to a repository — even if the commit was reverted, the key is in git history
• Enable Anthropic API key usage alerts and billing limits to detect LLMjacking abuse
• Remove API keys from client-side code — proxy all AI API calls through an authenticated backend
• Audit .env files in Docker images: run 'docker history' on all published images to check for embedded secrets

Workarounds

• Use environment variable injection at runtime (not build time) for all API keys
• Implement API key scoping: separate keys for development, staging, production with different quotas
• Use short-lived API tokens where supported instead of long-lived API keys
• Monitor Anthropic billing dashboard daily for unexpected usage spikes

Longer-term hardening

• Implement secret management vault (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault) for all API keys
• Deploy pre-commit hooks (TruffleHog, GitGuardian, detect-secrets) to prevent API key commits
• Implement API key rotation policy: 90-day maximum lifetime, immediate rotation on suspected compromise
• Enable GitHub push protection (blocks commits containing detected secrets before they reach the repo)
• Implement per-key usage quotas and IP allowlists on Anthropic API keys
• Deploy API gateway/proxy between applications and AI APIs — centralize key management and add rate limiting

Affected and fixed versions

• Anthropic — Claude API / Self-hosted instances
  Vulnerable versions: Exposed instances without authentication
  Fixed in: Properly secured deployments

Timeline

• 2022-11-30 OpenAI launches ChatGPT. Massive developer adoption of AI APIs begins. API key management practices lag behind adoption speed. First wave of OpenAI API key leaks on GitHub.
• 2023-03-14 Anthropic launches Claude API for public access. Developer adoption accelerates. API keys begin appearing in public GitHub repositories within weeks. Key format: sk-ant-api02-*.
• 2023-06-01 GitGuardian reports GenAI API key leaks surging on GitHub. OpenAI keys: 1212x increase from 2022. Anthropic, Gemini, HuggingFace, Cohere keys growing rapidly. AI keys become fastest-growing leaked secret category.
• 2023-12-01 GitGuardian 2023 year-end data: 12.8M secrets detected on GitHub, 8M commits with at least one secret. 1 in 10 commit authors leaked a secret. India, US, Brazil lead leak counts. Source: https://www.gitguardian.com/state-of-secrets-sprawl-report-2024
• 2024-03-01 GitGuardian publishes State of Secrets Sprawl 2024 report. Highlights 1212x increase in OpenAI key leaks. Anthropic/Claude identified as 'rapid penetration' in leak data. AI service adoption measurable through leak volume trends.
• 2024-05-06 Wiz and Sysdig publish LLMjacking research: attackers using stolen API keys and cloud credentials for free AI inference. Establishes economic model: underground AI inference at $0.01-$0.10/1K tokens vs $0.015-$0.075 legitimate. Source: https://sysdig.com/blog/llmjacking-stolen-cloud-credentials-used-in-new-ai-attack/
• 2024-07-01 GitHub expands push protection to detect and block AI API key commits before they reach repositories. Supports OpenAI, Anthropic, and other AI provider key patterns. Adoption slow — many developers disable to unblock pushes.
• 2024-10-01 Automated GitHub dorking bots scanning new commits in real-time for AI API keys. Median time from commit to exploitation: 11 minutes. Dedicated Telegram channels share discovered keys within minutes.
• 2025-01-01 Anthropic migrates to sk-ant-api03-* key format. New format does not include built-in expiry. Keys remain valid indefinitely unless manually rotated. Legacy sk-ant-api02-* keys still accepted.
• 2025-03-01 Claude Opus pricing: $15/$75 per million tokens input/output. Premium pricing makes Anthropic keys among the most valuable targets for LLMjacking — higher per-token cost = higher abuse value.
• 2025-06-01 Docker image secret leaks become major vector. Developers bake .env files into Docker images during build. Public images on Docker Hub contain Anthropic, OpenAI, AWS, and database credentials. docker history command reveals embedded secrets.
• 2025-09-01 LLMjacking-as-a-service market matures on Telegram and dark web. Stolen API keys sold with remaining quota information. Pricing: $0.01-$0.10/1K tokens (80-95% discount). Monthly jacking revenue estimated $10M-$50M across all AI providers.
• 2025-12-01 Credential chain exploitation pattern documented: leaked .env file contains ANTHROPIC_API_KEY + DATABASE_URL + AWS_SECRET_ACCESS_KEY + STRIPE_SECRET_KEY. Single file leak enables multi-service compromise. API key is the canary; .env file is the breach.
• 2026-01-01 Active scanning campaigns for Anthropic API endpoints intensify. Scanners target: GitHub commits (real-time), public Docker images, Terraform state files, Jupyter notebooks, Pastebin/Ghostbin, and CI/CD build logs.
• 2026-02-01 Key rotation analysis: median time to rotate a leaked AI API key = 12+ days. Most leaked keys are never rotated. Anthropic keys have no built-in expiry — a key leaked in 2023 may still be valid and abusable in 2026.
• 2026-02-11 Threadlinqs Intelligence analysis: Anthropic API key exposure represents the credential management failure of the AI era. 1212x increase in GenAI key leaks, 11-minute median exploitation time, and no built-in key expiry create a persistent, growing attack surface. The API key IS the perimeter — when it leaks, the perimeter is gone.
• 2026-05-29 As of 2026-05-29, this LLMjacking/Anthropic API-key scanning threat remains active and intensifying: GitGuardian's State of Secrets Sprawl 2026 reports 28.65M GitHub secrets leaked in 2025 (+34% YoY) and AI-service keys +81% YoY, with active validation/resale ops (Operation Bizarre Bazaar, silver.inc) still running. It is a credential-exposure class with no CVE to patch; Microsoft's Storm-2139 action curbed one syndicate but not the phenomenon, so MONITORING holds.

Sources cited

• OWASP — Secrets Management Cheat Sheet cheatsheetseries.owasp.org · Advisory · 2025-01-01
• NIST SP 800-63B — Digital Identity Guidelines: Authentication and Lifecycle Management NIST · Advisory · 2023-12-01
• GitGuardian — State of Secrets Sprawl Report 2024: 12.8M Secrets on GitHub gitguardian.com · Vendor report · 2024-03-01
• Sysdig — LLMjacking: Stolen Cloud Credentials Used for AI Inference sysdig.com · Vendor report · 2024-05-06
• Wiz Research — LLMjacking: Stolen Compute for AI Model Abuse Wiz · Vendor report · 2024-05-06
• Anthropic — API Key Management and Security Best Practices docs.anthropic.com · Vendor report · 2025-12-01
• GitHub — Secret Scanning: Detecting Leaked API Keys in Commits GitHub · Vendor report · 2025-12-01
• GitGuardian — GenAI API Key Leaks: 1212x Increase in OpenAI Key Exposure blog.gitguardian.com · Vendor report · 2024-03-15
• Anthropic — Usage and Billing: Rate Limits and Quota Management docs.anthropic.com · Vendor report · 2026-01-01
• Anthropic — API Documentation docs.anthropic.com · Vendor report · 2026-01-01
• SANS ISC Diary: Scanning for Anthropic API Endpoints isc.sans.edu · 2026-02-02
• Truffle Security — TruffleHog: API Key and Secret Detection Tool trufflesecurity.com · Other · 2025-12-01

Related threats

• Anthropic API Scanning Campaign - Targeting Self-Hosted LLM Infrastructure

Previous and next in threat intel

• Cyber Insights 2026: AI-Powered Malware and Attack Evolution Previous report
• Citrix NetScaler Mass Reconnaissance Campaign via Residential Proxies Next report