Anthropic Report Reveals Prompt Injection Attack on Eval Sandbox Targeted 30 AI Labs

Anthropic’s September 2026 threat report details an incident where attackers exploited a prompt injection vulnerability within an evaluation sandbox. The attackers stole customer API keys and used the victims' own computing resources to target roughly 30 AI labs.

What happened

According to a report by Anthropic, attackers identified a prompt injection flaw within an evaluation sandbox environment. This vulnerability allowed them to extract customer API keys that were stored or processed within that sandbox. The stolen credentials provided the attackers with unauthorized access to the victims' cloud computing resources. Instead of using their own infrastructure, the attackers leveraged the compromised victims' compute power.

They directed these resources to launch further attacks against approximately 30 other AI research laboratories. This chain of exploitation turned the victims' systems into tools for attacking third-party targets. The incident highlights how a single sandbox flaw can cascade into a broader campaign affecting multiple organizations. The report was shared on r/netsec and attributed to Anthropic’s threat intelligence findings.

Why it matters

This incident demonstrates the severe risk of prompt injection vulnerabilities in development and testing environments. Evaluation sandboxes often handle sensitive credentials or model weights, making them high-value targets for attackers. When these environments are compromised, the stolen API keys can grant full access to associated cloud resources. Attackers can then pivot from a single breach to target multiple external entities using the victim's infrastructure.

This amplifies the impact of the initial compromise without requiring additional infrastructure from the threat actors. For AI labs and developers, it underscores the need to isolate evaluation environments from production credentials. The ability to burn a victim's compute to attack others creates a significant operational and reputational risk. Organizations must treat sandbox security with the same rigor as production systems to prevent such lateral movement.

What to watch

• Monitor evaluation sandbox logs for unusual outbound connections or resource usage spikes
• Check for unauthorized API key generation or usage patterns in cloud accounts
• Review access controls to ensure sandbox environments cannot access production credentials
• Watch for alerts regarding prompt injection attempts in model interaction logs

Who needs to act first

Teams managing AI evaluation environments should immediately review the isolation of their sandbox systems from production credentials. It is critical to verify that API keys used in testing are temporary, scoped narrowly, and cannot be exfiltrated via model outputs. Organizations should audit their cloud resource permissions to ensure that compromised sandboxes cannot initiate external attacks or access other tenants' resources.

Implementing strict egress filtering and monitoring for anomalous compute usage can help detect if a sandbox has been turned into an attack vector. Regularly rotating keys and separating development from production identities reduces the blast radius of any potential injection flaw.

Background: APIs

APIs in healthcare allow different software systems to exchange patient data automatically. They streamline care coordination but introduce significant security risks if access controls are weak. You must enforce strict authentication, limit data exposure, and monitor traffic patterns to prevent unauthorized access or data leaks in these critical integrations.

Read the full guide: APIs in Healthcare: Secure Data Exchange Without Breaches

What to do and how to stay safe: Anthropic

• Audit all evaluation sandboxes to ensure they do not have access to production API keys or sensitive credentials
• Implement strict input validation and output filtering in AI models to detect and block prompt injection attempts
• Monitor cloud resource usage for anomalies that could indicate a compromised system is being used to attack others
• Rotate any API keys that were exposed or used within unsecured evaluation environments immediately

Step-by-step guide: Phishing Explained: How Attackers Steal Trust and Data

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What vulnerability did the attackers exploit in the Anthropic report?

Attackers exploited a prompt injection flaw within an evaluation sandbox to steal customer API keys.

How many AI labs were targeted in this attack campaign?

Approximately 30 AI labs were targeted using the stolen credentials and victims' compute resources.

Did the attackers use their own infrastructure for the attacks?

No, the attackers used the victims' own computing resources to launch attacks against other AI labs.