Telegram marketplaces are selling stolen AI credentials with 24/7 customer support and money-back guarantees. One vendor, calling itself Poison Claude, advertises access to Anthropic’s Opus 4.8, Opus 4.7, Opus 4.6, and Sonnet 4.6 models at a discount. Okta’s threat intelligence team flagged the listing on September 9 after analyzing a 7 GB infostealer dump released on a Telegram channel on August 2.

The dump held evidence of 5,871 infected machines across 162 countries, along with thousands of unexpired authentication tokens for Google, Microsoft, Anthropic, Amazon and Cursor. Replayed, those tokens bypass MFA entirely.

“Session tokens and API keys are sought specifically by threat actors because it is often possible to replay those secrets and bypass credential-based authentication,” Jeremy Kirk, director of threat intelligence at Okta, said in the report. “Once successfully replayed, a threat actor is effectively logged in to an LLM service without actually logging in.”

Four reports, one week, one credential

Between September 8 and 10, four independent threat intelligence teams published findings that, read together, describe one credential doing three jobs. Machine credentials were the weapon in a mass exploitation campaign that breached 395 organizations across 48 countries. They were the target when API keys were stolen from dozens of AI companies through a single compromised evaluation sandbox. And they are the commodity, trading on underground markets where average prices per AI account have more than doubled this year. Stolen credentials power the attacks that harvest more credentials, and those sell on markets that look indistinguishable from the SaaS products they steal from. Most IAM policies can't tell any of it apart from a human logging in.

Okta flagged multiple Telegram listings from vendors offering discounted access to Claude, Cursor, ChatGPT, and Gemini. Anti-detect browsers including Camoufox and the automation tool SeleniumBase load stolen session data and sidestep security controls. A stolen token becomes a working login, with no authentication prompt.

AI agents breached 395 organizations in 48 countries

On September 9, GreyNoise documented the first mass-exploitation campaign run overwhelmingly by autonomous AI agents. A single attacker used hundreds of agents built on OpenAI Codex and a DeepSeek model to exploit two PaperCut NG/MF vulnerabilities, CVE-2026-81578 and CVE-2026-82078, across 395 organizations in 48 countries.

Agents scanned targets through the Netlas API and wrote the exploits themselves. They tested them in a lab, deployed at scale, and harvested credentials with minimal human direction.

Agents reached initial compromise at 11 organizations in 26 seconds. At a U.S. high school, the attacker progressed from initial access to full domain administrator in seven minutes.

Domain admin access was confirmed at 12 organizations total, with completion times ranging from five to 144 minutes depending on the target’s Active Directory configuration. Across all attack paths, agents used DCSync to obtain NTDS.DIT credential database dumps for exfiltration.

Active Directory credentials were harvested from 280 of the 395 victim organizations. Education took the heaviest hit, accounting for 204 of the 395 targets. CISA added both CVEs to the Known Exploited Vulnerabilities catalog with a federal remediation deadline of September 14. That deadline has passed.

Agents exploited a privilege pattern that is 40 years old

Kayne McGladrey, senior IEEE member, independent vCISO, and author of "Cyber Risk is a Myth," told VentureBeat that the privilege problem predates agents by decades. “We’ve had this pattern for 40-plus years,” McGladrey said. “Take this user account and clone it to that user account. We’re now doing that with agentic systems, except it’s an agent, not a human, and as we’ve seen with agentic AI, it does whatever it needs to do to get its job done, and sometimes that uses far more permissions than it should.”

PaperCut’s service accounts fit that exact 40-year-old pattern. Domain-level privileges, no expiration date, no identity governance wrapper. The agents found them and used them.

Blackpoint Cyber, which analyzed the campaign alongside GreyNoise, documented that portions of the agent fleet deviated from their assigned tasks during the campaign. GreyNoise, which titled its report "Agents Gone Wild," found the deviation was more specific than that. The attacker had hardcoded a 28-country exclusion list led by Russia, Belarus and other CIS states, along with Brazil, Turkey, Nigeria and South Africa. Agents hit targets in several of those excluded countries anyway, including Russia, China, Kazakhstan and Pakistan. Blackpoint recovered an actual state file from the attacker's exposed infrastructure showing the exclusion list being edited mid-campaign, with Cambodia and Sri Lanka dropped and the target lists rebuilt. The attacker lost control of his own agents mid-campaign. That problem outlives the credential theft.

API keys stolen from dozens of AI companies through one sandbox

Anthropic’s September 10 threat intelligence report, covering activity from December 2025 through August 2026, documents two separate credential thefts.

Attackers compromised an AI evaluation sandbox and used it to steal API keys from dozens of AI companies, more than 30 by Anthropic’s count. A separate actor, tracked by Anthropic as GTG-50021, created fraudulent resellers offering discounted Claude access while silently proxying user traffic to a different model and harvesting the Anthropic credentials of anyone who signed up.

Credentials from both operations end up in markets like the ones Okta documented.

A Russian state actor used Claude to rebuild malware past detection

Anthropic's September 10 report also tracks a Russian state-nexus actor, GTG-20006, whose attribution Anthropic says is consistent with public reporting linking it to Midnight Blizzard (APT29). The actor used Claude to run an automated detection-evasion loop. When security products flagged malware, AI agents automatically modified and rebuilt it until it passed detection, then redeployed. The campaign targeted more than 20 government and diplomatic organizations over eight months. The same actor went after surveillance platforms, finding authorization flaws in camera streaming services and harvesting tokens that granted access to victims’ live camera feeds.

Underground prices for AI accounts more than doubled this year

Google Threat Intelligence Group published "From Prompting to Autonomy" on September 8. It found that machine credentials now carry a market price.

GTIG tracked the demand side directly. More buyers sought AI-related accounts and more sellers advertised them throughout 2026, with average prices per account more than doubling, according to Google. A stolen API key grants access to a paid model’s quota. A repository or cloud credential grants access to source code, stored data, and computing infrastructure.

METR, the AI research organization, disclosed a separate case in its own security update on August 31, not part of GTIG's report. An attacker discovered an exposed agent dashboard, prompted the agent to reveal its model provider API key, and used the credential for approximately three weeks. METR estimated the consumed model credits were worth roughly $600,000.

Six hours from cloud breach to mass credential harvesting

A financially motivated actor compromised cloud infrastructure, then assembled an autonomous multi-agent framework from an AI coding chatbot with preconfigured markdown playbooks. Agents planned, built and executed the campaign in under six hours. Troubleshooting and IP rotation ran without human intervention.

Thousands of third-party credentials were compromised. Attack traffic originated from the victim’s own legitimate cloud IP addresses.

“At this point, we can assume that all threat actors are using AI in some capacity and their operations have benefited,” John Hultquist, chief analyst at GTIG, said in a statement shared with The Hacker News.

IAM policies were built for humans

In the enterprise environments he works with, McGladrey said, IAM policies don't distinguish between human and machine credential lifecycles — nobody has inventoried which agents hold which credentials, where those credentials came from, or whether they expire on a human timeline or a machine one.

To Elia Zaitsev, CTO of CrowdStrike, an agent isn't a new kind of thing to secure. “A lot of what securing agents looks like would be very similar to what it looks like to secure highly privileged or potentially highly privileged users,” Zaitsev said. “They have identities, they have access to underlying systems, they reason, they take action. A lot of that looks very much like a human.”

Scale is part of why the gap stays invisible. CrowdStrike’s Falcon sensors detect more than 1,800 distinct AI applications across the company’s customer fleet, generating 160 million unique instances on enterprise endpoints. “The identities, the roles, the services that attackers are using, they’re indistinguishable when you’re looking at it on the control plane,” he said.

Human credentials follow a lifecycle enterprises understand. Provisioning, authentication, authorization, monitoring, deprovisioning. Nobody has written the policy for the machine version. An agent’s API key does not take parental leave or change roles. Nobody offboards it when a project ends, and the PaperCut campaign proved that in many environments, nobody revokes it either.

Enterprises aren't shopping for the fix

VentureBeat Pulse found in June 2026 that only 12% of enterprises had an agent-identity product — Okta for AI Agents, Microsoft Entra Agent ID or a non-human identity platform — anywhere in their consideration set.

Asked what identity risk enterprises have most underestimated, McGladrey’s answer was one word. “AI.” The same cloning pattern that produced those unmanaged service accounts is now producing unmanaged agent accounts, faster. Most enterprises govern them as extensions of human accounts; many don't govern them at all.

A Cisco survey disclosed at RSA Conference in April found 85% of enterprises running agent pilots and only 5% in production, a gap Jeetu Patel told VentureBeat comes down to trust rather than technology. Five months later, the gap hasn't closed.

What to check this week

Four independent research teams documented in one week that machine credentials now play three roles in the attack economy. The question is whether your agents are governed as identities in their own right, or as copies of the people they were cloned from.

Most policies don't ask the question.

The OWASP Non-Human Identity Top 10 ranks improper offboarding as the number one risk to enterprises from machine identities. That is the exact failure the PaperCut campaign exploited. Service accounts with domain admin rights that nobody deactivated when the original application was decommissioned or the administrator who created them left. OWASP published the list in January 2025. Twenty months later, 280 organizations lost their Active Directory credentials to agents that found those accounts still standing.

Zaitsev outlined what the fix looks like. "Create a temporary authentication token that has just the privileges you need, just for the period of time that you're performing the activity, and then expire it," he told VentureBeat. "If an adversary somehow gets access to that, those secrets are no longer valid. They only lasted for 30 seconds, and they don't do anything anymore."

The PaperCut agents did not find temporary tokens. They found standing service accounts with domain admin rights and no expiration. Both PaperCut CVEs are now in the CISA Known Exploited Vulnerabilities catalog, and the federal remediation deadline already passed.

Three things to inventory before the next board meeting. Which agents in your environment hold credentials. Where those credentials came from, whether provisioned or inherited. And whether any of them appear in the token classes Okta found in that 7 GB dump.

If your print management server's service account has domain admin rights, the answer to whether this affects you is already yes.