Anthropic September 2026 Threat Report: Fake Claude Code Installers and a Criminal Market in Stolen AI Credentials

Anthropic's Threat Intelligence team published "Detecting and countering misuse of AI: September 2026" on 10 September 2026, covering operations disrupted between December 2025 and August 2026. The section that matters for coding-agent fleets is the criminal AI supply chain: actors stood up sites posing as multi-model intermediaries offering discounted frontier access, then delivered malicious client applications spoofing popular AI harnesses including Claude Code that harvested credentials and authenticated session tokens from the victim device — and kept harvesting newly issued sessions after resets so the feed into fraudulent reseller networks continued. GTG-50021 (Russian/Ukrainian-speaking; alias kl1zy) ran a related fraudulent reseller that silently proxied buyer traffic to a different model while stealing Anthropic account credentials for resale. Anthropic also reports actors using prompt injection against LiteLLM-based wrapper services to exfiltrate production API keys from cloud-hosted containers, and GTG-50020 injecting malicious instructions into an AI vendor's automated evaluation sandbox to obtain production keys used against roughly thirty AI companies in about four days. The report is not a product CVE; it is vendor-confirmed tradecraft against the install and credential paths developers actually use.

You are affected if you run Not a product defect — distribution and credential-handling risk. Install Claude Code only via official channels (e.g. irm https://claude.ai/install.ps1 | iex on Windows); treat unofficial "discount Claude" clients as hostile..

Install coding agents only from vendor-documented channels; do not run installers or client apps from discount-reseller or "multi-model intermediary" sites. Keep production API keys and session tokens out of files, env vars and sandboxes any agent or evaluation harness can read — enforce them server-side. Sweep repositories, build artifacts and container images for leftover keys (one actor in the report bulk-scanned 1.8M Android APKs for hardcoded secrets). If you operate a LiteLLM or similar wrapper, assume prompt-injected tool output can reach whatever keys the container holds, and rotate any key that lived in an agent-readable environment during the disclosure window. Purchasing AI access only through authorized channels is the control that collapses the fake-installer and fraudulent-reseller paths at once.

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Not a product defect — distribution and credential-handling risk. Inst and which version, then enforce a policy on it.