FREE · 5 MINUTES
By Abi Odedeyi · CodeFreeIQ
Your AI keys are somebody's target now
Two case studies in Anthropic's September threat report are about stolen customer keys, not drones. Here is the check to run on yours.
By Abi Odedeyi · CodeFreeIQ🔑
Find them
Every place a key is sitting, including the screenshot you sent a contractor.
🔄
Rotate and revoke
Regenerate, update, then revoke. In that order.
🗓️
Put a date on it
Quarterly beats doing it after something goes wrong.
Get the five-minute check
Pop your details in and they unlock right here.
No spam. Unsubscribe anytime.
The check, step by step
Where this comes from. Anthropic's threat report, Detecting and countering misuse of AI: September 2026, published 10 September. Two of its case studies are about stolen customer API keys rather than anything dramatic. Their own line is that organisations should treat AI keys with the same seriousness as production credentials, because attackers already do.
1. Find every place a key of yours is sitting
Search your own systems for the prefixes your providers use. Most keys start with a recognisable string, so search for that rather than the word "key". Check: your notes app, your password manager, any spreadsheet, your automation tools, your code, your email, and any group chat where you sent one to someone.
The screenshot is the one people forget. A key pasted into a chat to help a contractor is still there, in their history as well as yours.
2. Rotate anything that has ever left your machine
Regenerate the key in the provider's dashboard, update the one place it genuinely needs to live, then revoke the old one. Do it in that order so nothing breaks while you are halfway through.
Rotating is not deleting. Most dashboards let the old key keep working until you explicitly revoke it. If you skip the revoke you have made a second key, not replaced the first.
3. Check where you bought your AI access
If you are paying anyone other than the provider itself for cheap access, check what you actually bought.
Why this one matters. The report describes a reseller offering discounted Claude access where, in Anthropic's words, customers' "traffic was in fact silently proxied to a different AI model while the reseller's tooling installed a credential harvester, stealing their Anthropic account credentials." Cheap access that is not from the company is worth an hour of your attention.
4. Give each tool its own key
One key per tool or per person, never one key everywhere. When something leaks you then revoke one thing instead of rebuilding everything.
This is the step that turns an incident into an inconvenience.
5. Put a date in the calendar
Rotate on a schedule, not when something goes wrong. Quarterly is enough for most small teams, and the calendar entry is what makes it happen.
One thing the report is clear about, so you do not panic. "In all of this, the keys involved were customers' keys stolen from customers' environments. The actor never compromised Anthropic's own systems." This is about where your keys live, not about the provider.