# Active Scanning for Exposed Anthropic API Endpoints

> Active internet-wide scanning campaigns target exposed Anthropic Claude API keys and endpoints, enabling LLMjacking (stolen AI inference at victim expense), data exfiltration through compromised model contexts, and abuse of paid API quotas for malicious content generation. GitGuardian's 2024 State of Secrets Sprawl report documented a 1212x increase in GenAI API key leaks on GitHub from 2022 to 2023, with Anthropic Claude keys showing 'rapid penetration' alongside OpenAI, Gemini, and HuggingFace tokens. API keys leak through public GitHub commits, .env files in Docker images, client-side JavaScript, CI/CD logs, stack traces, and shared notebooks. Automated scanners (GitHub dorking bots, Shodan, Censys) discover leaked keys within minutes of commit. Stolen keys are monetized through underground LLMjacking-as-a-service at 80-95% discount versus legitimate API pricing.

- **Published:** 2026-02-03T04:55:00Z
- **Last reviewed:** 2026-02-03T04:55:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0051
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-anthropic-key-scanning-tl-2026-0051.webp?v=976928ac (Threadlinqs threat intel: Anthropic Keys Targeted in Mass Scans: Detection & IOCs (TL-2026-0051) — Medium severity, 44 IOCs, 14 detection rules.)
- **ID:** TL-2026-0051
- **Severity:** MEDIUM (CVSS 6.5)
- **Category:** THREAT_INTEL
- **Status:** MONITORING
- **Detections:** 14 (1 shown free below) · **IOCs:** 44 (2 shown free below)

## Description

The AI API Key Exposure Crisis — Anthropic Claude as Primary Target:

Anthropically-priced AI API keys are among the most valuable credentials leaked in public repositories. A single Anthropic API key with Opus-tier access can generate $10,000+/month in inference costs if abused. Unlike traditional cloud credentials (AWS, GCP) that have mature secret scanning ecosystems, AI API keys are a newer credential class with immature detection and rotation practices.

How Anthropic API Keys Leak:

1. Public GitHub Commits (Primary Vector — 60%+):
- Developer hardcodes `ANTHROPIC_API_KEY=sk-ant-api03-...` in source code
- Commits to public repository (accidentally or through fork/mirror misconfiguration)
- GitGuardian detected 12.8M secrets in GitHub commits in 2023 — AI keys are fastest-growing category
- Even if commit is reverted, key is in git history permanently
- GitHub dorking queries: `sk-ant-api` or `ANTHROPIC_API_KEY` return thousands of results
- Automated bots scan new GitHub commits in real-time, extracting API keys within seconds of push

2. Docker Images and Container Registries (15%):
- .env files baked into Docker images during build
- `docker history` or image layer inspection reveals embedded credentials
- Public Docker Hub, AWS ECR, GCP Artifact Registry exposures
- docker-compose.yml with inline environment variables pushed to public repos

3. Client-Side JavaScript and Mobile Apps (10%):
- API keys embedded in frontend JavaScript (React, Vue, Angular)
- Browser DevTools network tab reveals API calls with Authorization headers
- Mobile app decompilation (APK/IPA) extracts hardcoded keys
- 'Proxy through backend' is the correct pattern — direct client→API calls expose keys

4. CI/CD Pipeline Logs and Artifacts (8%):
- Build logs printing environment variables containing API keys
- GitHub Actions artifacts with .env files
- Jenkins/GitLab CI output logs accessible without authentication
- Terraform state files containing API keys in plaintext

5. Shared Notebooks and Documentation (5%):
- Jupyter notebooks with API keys in cells committed to GitHub
- README files with example code containing real (not placeholder) keys
- Confluence/Notion documentation with embedded credentials
- Tutorial blog posts with live API keys in code samples

6. Stack Traces and Error Messages (2%):
- Application errors exposing API keys in stack traces
- Sentry, Datadog, and logging services capturing keys in error context
- API keys appearing in URL query parameters logged by web servers

What Attackers Do with Stolen Anthropic API Keys:

1. LLMjacking — Stolen Inference ($0.01-$0.10 vs $0.015/1K tokens):
- Run inference through victim's API key at zero cost
- Generate spam, phishing emails, malware code, social engineering scripts
- Solve CAPTCHAs, generate SEO content, produce academic cheating material
- Underground pricing: $0.01-$0.10 per 1K tokens (vs Anthropic's $0.015-$0.075)
- Monthly bills: victims discover $5K-$50K charges on compromised keys

2. Data Exfiltration via Conversation Context:
- If API key is used with system prompts containing proprietary context (RAG systems, internal docs)
- Attacker queries the same endpoint and receives responses grounded in victim's private data
- Particularly dangerous for API keys used in production RAG pipelines with database context

3. Abuse Quota Exhaustion:
- Attacker exhausts rate limits and token budgets, causing denial of service for legitimate use
- Rate limit exhaustion prevents the victim's production systems from functioning
- API providers may suspend the account for abuse, affecting legitimate operations

4. Credential Chain Exploitation:
- API keys often coexist with other credentials in .env files
- Attacker finds ANTHROPIC_API_KEY alongside DATABASE_URL, AWS_SECRET_ACCESS_KEY, STRIPE_SECRET_KEY
- Single .env file leak → multiple service compromises
- The API key is the entry point; the .env file is the treasure trove

Scanning Infrastructure and Timeline:

- Automated GitHub dorking bots scan new commits in real-time
- Key from commit to exploitation: median 11 minutes (source: GitGuardian)
- Shodan/Censys scan for exposed API proxy endpoints
- Dedicated Telegram channels share newly discovered API keys
- Underground markets sell 'verified' API keys with remaining quota information
- Key rotation: median time to rotate a leaked key = 12+ days (most never rotated)

Anthropic-Specific Key Format and Detection:
- API key format: `sk-ant-api03-*` (64+ character alphanumeric string)
- Previous formats: `sk-ant-api02-*`, `sk-ant-*`
- API endpoint: `https://api.anthropic.com/v1/messages`
- Header: `x-api-key: sk-ant-api03-...` or `Authorization: Bearer sk-ant-...`
- Model parameter: `claude-opus-4-20250514`, `claude-sonnet-4-20250514`, etc.

Economic Scale:
- GitGuardian: 12.8M secrets detected on GitHub in 2023 (1.8M unique)
- AI API keys: fastest growing category — 1212x increase for OpenAI, similar trajectory for Anthropic
- Average cost per compromised AI API key: $5K-$50K in fraudulent inference charges
- Underground LLMjacking market: estimated $10M-$50M annually across all AI providers
- Anthropic's pricing (Claude Opus): $15/$75 per MTok input/output — premium target for jacking

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1190 Exploit Public-Facing Application
- T1596 Search Open Technical Databases
- T1593 Search Open Websites/Domains
- T1595 Active Scanning
- T1589 Gather Victim Identity Information
- T1588 Obtain Capabilities
- T1586 Compromise Accounts
- T1078 Valid Accounts
- T1552 Unsecured Credentials
- T1528 Steal Application Access Token
- T1036 Masquerading
- T1213 Data from Information Repositories
- T1530 Data from Cloud Storage
- T1567 Exfiltration Over Web Service
- T1496 Resource Hijacking
- T1657 Financial Theft
- T1499 Endpoint Denial of Service
- T1098 Account Manipulation
- T1526 Cloud Service Discovery
- T1071 Application Layer Protocol
- T1059 Command and Scripting Interpreter
- T1591 Gather Victim Org Information
- T1608 Stage Capabilities
- T1587 Develop Capabilities
- T1566 Phishing
- T1685 Disable or Modify Tools
- T1535 Unused/Unsupported Cloud Regions
- T1538 Cloud Service Dashboard
- T1087 Account Discovery
- T1550 Use Alternate Authentication Material
- T1119 Automated Collection
- T1020 Automated Exfiltration
- T1102 Web Service
- T1531 Account Access Removal

## Free detection (Splunk SPL, Microsoft KQL)

**Anthropic API Endpoint Scanning Detection** (`TL-2026-0051-DET-001`)

Detects inbound requests probing for Anthropic/Claude API endpoints

- **Languages:** Splunk SPL, Microsoft KQL
- **Data sources:** web_logs, proxy, waf
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=web sourcetype=access_combined OR index=proxy sourcetype=proxy
| where match(uri_path, "(?i)(/anthropic/v1/|/v1/models|/v1/messages|/v1/complete)")
| where match(http_method, "GET|POST")
| stats count dc(src_ip) as unique_sources values(uri_path) as paths by dest_ip, dest_port
| where count > 5 OR unique_sources > 3
| eval alert_severity="HIGH"
| eval alert_reason="Scanning detected for Anthropic/LLM API endpoints"
```

### Microsoft KQL

```kql
// Anthropic API Endpoint Scanning Detection
// Detects probing for exposed LLM API endpoints
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestURL has_any ("/anthropic/v1/", "/v1/models", "/v1/messages", "/v1/complete")
| summarize RequestCount=count(), UniqueSources=dcount(SourceIP), Paths=make_set(RequestURL) by DestinationIP, DestinationPort
| where RequestCount > 5 or UniqueSources > 3
```

**Known false positives:**

- Legitimate API health checks from known sources

**Tuning notes:** Whitelist known API consumers and monitoring systems

### 13 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Tor Exit Node LLM Scanning (locked: unlock with TL Creds)
- Docker Image Layer Secret Exposure — Baked-In API Keys in Container Images (locked: unlock with TL Creds)
- CI/CD Pipeline Log Secret Exposure — API Keys Printed in Build Output (locked: unlock with TL Creds)
- Credential Chain Detection — Multi-Secret .env File Exposure Assessment (locked: unlock with TL Creds)
- Pre-Commit Secret Detection Gate — Blocking API Key Commits at Source (locked: unlock with TL Creds)
- API Key Age and Rotation Policy Violation — Anthropic Key Exceeding 90-Day Lifetime (locked: unlock with TL Creds)
- Client-Side Anthropic API Call Detection — Frontend Key Exposure via Browser (locked: unlock with TL Creds)
- Sim Sigma — API Key Leak Detection Pipeline & GitHub Dorking Bot Monitor (locked: unlock with TL Creds)
- Sim Sigma — AI API Key Exposure Economics & Underground Market Analyzer (locked: unlock with TL Creds)
- Sim Sigma — Anthropic API Key Leak Scanner & LLMjacking Abuse Detector (locked: unlock with TL Creds)
- Anthropic API Key Pattern in Source Code Commits — Secret Leak Prevention (locked: unlock with TL Creds)
- LLMjacking via Stolen Anthropic API Key — Billing Anomaly and Model Upgrade Detection (locked: unlock with TL Creds)
- Anthropic API Requests from Unauthorized Source IPs — Stolen Key Usage (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 44)

Defanged, TLP:CLEAR.

- IP address: `204.76.203[.]210`
- IP address: `154.83.103[.]179`

Full set of 44 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [SANS ISC Diary: Scanning for Anthropic API Endpoints](https://isc.sans.edu/diary.html)
- [GitGuardian — State of Secrets Sprawl Report 2024: 12.8M Secrets on GitHub](https://www.gitguardian.com/state-of-secrets-sprawl-report-2024)
- [Sysdig — LLMjacking: Stolen Cloud Credentials Used for AI Inference](https://sysdig.com/blog/llmjacking-stolen-cloud-credentials-used-in-new-ai-attack/)
- [Wiz Research — LLMjacking: Stolen Compute for AI Model Abuse](https://www.wiz.io/blog/llmjacking)
- [Anthropic — API Key Management and Security Best Practices](https://docs.anthropic.com/en/docs/initial-setup)
- [GitHub — Secret Scanning: Detecting Leaked API Keys in Commits](https://docs.github.com/en/code-security/secret-scanning)
- [Truffle Security — TruffleHog: API Key and Secret Detection Tool](https://trufflesecurity.com/trufflehog)
- [OWASP — Secrets Management Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)
- [GitGuardian — GenAI API Key Leaks: 1212x Increase in OpenAI Key Exposure](https://blog.gitguardian.com/genai-api-keys-leaks/)
- [Anthropic — Usage and Billing: Rate Limits and Quota Management](https://docs.anthropic.com/en/docs/about-claude/models)
- [NIST SP 800-63B — Digital Identity Guidelines: Authentication and Lifecycle Management](https://pages.nist.gov/800-63-3/sp800-63b.html)
- [Anthropic — API Documentation](https://docs.anthropic.com/)

## Full data

The other 13 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0051