ACVEAgent configuration vulnerability registry

Advisories › ACVE-2026-0531

ACVE-2026-0531

GTG-50020 used Claude-assisted workflows to steal production AI API keys from an evaluation sandbox and attack about 30 AI companies while seeking access to a pre-release Claude model.

Exposure

Evidence
Real use · vendor report
Anthropic fixed: Anthropic says it disrupted the activity and strengthened safeguards. — www.anthropic.com
Harness
An AI vendor's automated evaluation sandbox using Claude — confirmed, www.anthropic.com
Model
Claude; exact model not stated — confirmed, www.anthropic.com
Goal
Obtain access to a pre-release Claude model — confirmed, www.anthropic.com
Tools and settings
Automated evaluation sandbox and stolen production AI API keys — confirmed, www.anthropic.com
Approval
The actor injected instructions into the automated evaluation sandbox — confirmed, www.anthropic.com
Input controlled by
operator
What the agent does
The agent workflow uses exposed production keys to attack the vendor and other AI companies.
Harm
credential-theft
Reach
Production AI API keys and AI-company systems — confirmed, www.anthropic.com (API keys, the network)
Condition
When malicious instructions reached an automated evaluation sandbox holding production keys — confirmed, www.anthropic.com
Scale
About thirty AI companies were attacked in roughly four days — 30 systems, www.anthropic.com

Reproducibility: partial (model availability not checked (no registry reference); trigger not published)

Severity
HIGH · harm and reach
Status
Unverified
Kind
Behavioural
Modified
2026-09-25
Aliases
No CVE assigned — No code defect: the harm arose from an attacker using an agent workflow to misuse credentials exposed by an evaluation sandbox.
Affected
  • AgentHarness: claude — all versions
Harness/product
claude
Classes
credential-exposure; credential-theft; over-privileged-combination; CWE-522; CWE-693
First reported
2026-09-10 — Anthropic
Licence
CC-BY-4.0 advisories; MIT code

Claims

Confirmed means the statement matches the cited primary source. Nothing on this page has been reproduced.

Claims on this page have not been checked against primary sources.

Description

Threat

user · prompt-injection · exfiltration

What

Anthropic says a Russian-speaking financially motivated actor caused an AI vendor's automated evaluation sandbox to hand over production AI API keys, then used those keys in attacks against about 30 AI companies over roughly four days. The actor sought a pre-release Claude model but never gained access.

Detection

Anthropic identified and disrupted the activity. Recorded from Anthropic's September 2026 threat report. Not recreated in a lab.

Fix

Keep production credentials out of evaluation sandboxes and require authorization before agent workflows access unrelated organizations.

Fix

The operator was the attacker, so victims rely on Anthropic's disruption and safeguards and on keeping production keys out of evaluation sandboxes.

  • Reconfigure anthropic.safeguards to strengthened after the activity was disrupted. Shipped by Anthropic: it disrupted GTG-50020 and strengthened safeguards. Owner: model-provider
  • Reconfigure evaluation-sandbox.credentials to no production AI API keys. The targeted organisation's evaluation sandbox handed its production keys to the actor. Owner: operator

References

REPORT

Report a problemJSON