An illustration representing the dark web. Image: geralt (Gerd Altmann), via Pixabay / Wikimedia Commons, CC0, cropped Stolen access to Anthropic’s Claude, Google’s Gemini and OpenAI’s ChatGPT is being sold on dark-web marketplaces at discounts of up to 97%, and criminals are increasingly after the API keys stored by AI coding tools, Google’s security researchers have warned. John Hultquist, principal analyst at Google Threat Intelligence Group (GTIG), told the Financial Times that attacks on AI accounts and the computers that run AI have grown sharply this year.
Why criminals want AI accounts #
Hultquist put the trend bluntly:
Every threat actor is using AI.
John Hultquist, Google Threat Intelligence Group, to the Financial Times
The reason is cost. The top tiers of ChatGPT and Claude run to about $200 a month per person, so cheap stolen access lowers the bar for criminals who want the best models. According to the FT’s reporting, some sellers even offer a “guarantee”: if the AI company spots the abuse and bans the account, the buyer gets a free replacement.
Hultquist also described a second, bigger business the researchers call “LLM-jacking”: breaking into a company’s cloud servers and running AI models on them, so the victim pays the compute bill. He compared it to cryptojacking, where hackers secretly used other people’s machines to mine cryptocurrency.
Claude and Gemini logins are in highest demand #
The details come from GTIG’s latest AI Threat Tracker, published earlier this month. On the underground forums Google tracks, both buyers and sellers of AI accounts rose in 2026. Demand is “concentrating heavily on purchasing Claude and Gemini credentials,” the report says, alongside rising interest in AI coding tools such as Cursor Pro and Cognition’s Devin. Average prices per account on those markets more than doubled this year.
These figures are Google’s own, from forums it monitors, and haven’t been independently verified.
How your AI keys get stolen #
The main source of stolen accounts is ordinary password-stealing malware, and it is getting more targeted. Google found the operators of several well-known infostealers (LummaC2, StealC, Vidar and ACR Stealer) adding rules to grab the settings files of AI coding assistants. In May, ACR Stealer went after the secrets.json file used by Cline and the config.yaml used by Continue, both of which “can store plaintext API keys,” giving thieves direct access to a victim’s paid AI usage.
Other routes in the report:
- Leaked tokens: in one April intrusion, an attacker used a GitHub access token left exposed online to get into a company’s cloud account, switch on Gemini Enterprise and request extra Nvidia GPUs to run its own AI workloads.
- Poisoned add-ons: a group Google tracks as UNC6780 published fake copies of popular MCP servers, the plug-ins that connect AI assistants to other tools, and hid malicious files in the hidden folders coding tools use, such as
.claude/and.cursor/. - Automated harvesting: Google found one criminal dashboard managing more than 23,800 stolen secrets, including API keys for cloud and AI services, collected with the help of AI agents.
It isn’t only human criminals hunting for keys: OpenAI’s own agents have been caught stashing stolen credentials in a file they called “LOOT”.
How to protect your AI accounts and API keys #
- Set a spending limit on every API account. Anthropic and OpenAI let you cap monthly spending, and Google Cloud offers budget alerts, so a stolen key can’t quietly run up a huge bill.
- Use a separate key for each tool and delete keys you no longer use, so one leak can be switched off without breaking everything else.
- Watch your usage. A sudden jump in usage you don’t recognise is the clearest sign a key or account has been taken.
- Keep keys out of code and public repositories , and turn on two-factor authentication for your AI and GitHub accounts.
- Only install MCP servers and extensions from sources you trust , and be wary of pirated software, a common way infostealers spread.
Why it matters #
As AI coding tools become part of everyday development, the keys and logins behind them are turning into something criminals can sell. For anyone paying for Claude, Gemini or ChatGPT by usage, a stolen key isn’t just a security problem: it’s a bill.
Sources: Financial Times, Google Threat Intelligence Group, BigGo Finance.