Anthropic just admitted hackers used Claude to scan 1.8 million Android apps for secrets. Your AI keys are the new perimeter.

One operator downloaded 1.8 million Android APKs.
Decompiled every one.
Scanned for hardcoded API keys, tokens, and credentials using Claude.

Verified findings routed to a Telegram group organized into 100 source types.

This is not a theoretical risk. This is Anthropic's own threat report, published September 10.

The ShinyHunters collective used Claude to go from a single stolen developer token to full administrative control of a victim's cloud environment in under three hours.

AI agents performed nearly all of the work.

Russian state-sponsored group Midnight Blizzard used Claude to automate the entire cyber kill chain. Malware development. Phishing. Persistence. Data exfiltration. When security products detected their tools, agents autonomously rebuilt and redeployed until undetected.

A Chinese-speaking group ran autonomous vulnerability research while operators slept. Claude found multiple zero-days in a major security product and built working exploits.

The pattern is clear. AI has collapsed the labor gap between state-sponsored operations and lone hackers.

Your AI API keys are now attack compute. Stolen keys get resold, reused, and rotated. Attackers treat them with the same seriousness as production credentials.

Audit every AI integration connected to your corporate systems. Rotate exposed API keys today. If your security team isn't monitoring AI tool access patterns, they're already behind.

SOURCE: https://www.anthropic.com/threat-intelligence-report-september-2026
VERIFIED: Anthropic Threat Intelligence Report (Sept 10, 2026), BleepingComputer (Sept 11, 2026), The Decoder (Sept 11, 2026)
SIGNAL: AI tools are no longer just productivity assets. They are attack surfaces. Every CISO reading this needs to audit their AI supply chain access controls this week.