Google Cloud’s Threat Intelligence Group reported in September 2026 that demand for stolen AI credentials had increased year over year across the underground forums it tracked. Buyers showed particular interest in Claude and Gemini accounts, along with AI coding tools such as Cursor Pro and Devin. GTIG also observed average underground marketplace prices per account more than doubling during 2026.
Stolen Claude and Gemini accounts for sale are part of a growing cybersecurity concern: criminals are finding ways to obtain AI access without paying for it themselves. The consequences extend beyond lost subscription fees. Compromised credentials can expose private information, enable unauthorized AI usage, and create financial or operational risks for businesses.
Google Cloud’s September 8, 2026, report, GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI, provides the central evidence for this story. It describes how threat actors target AI accounts, developer credentials, and cloud infrastructure to obtain access to valuable computing resources.
The important distinction is that an underground-market trend does not prove that every AI provider or user has been compromised. Understanding what criminals are targeting, how credentials are exposed, and which protective measures work best gives users and organizations a more practical way to respond.
Why Stolen Claude and Gemini Accounts Have Become Valuable Targets
AI services offer more than a chat interface. Depending on the account and its permissions, they can provide access to advanced models, coding assistance, saved conversations, integrations, and paid usage allowances. Developers may also connect AI tools to applications, repositories, and cloud services.
That combination creates several incentives for criminals.
Demand for premium AI access and coding tools
GTIG reported increased buyer demand for Claude and Gemini credentials in the underground forums it monitored during 2026. It also observed growing interest in autonomous coding environments, including Cursor Pro and Devin. Average underground marketplace prices per account more than doubled during the year, according to the report.
These findings describe the activity visible to GTIG, not the complete size of the underground market. They also do not establish a universal price for stolen accounts or prove that every listing represents valid access.
For attackers, compromised credentials can provide access to AI capabilities without purchasing legitimate subscriptions or usage credits. For some, the objective is to support other cybercrime activities. Others may seek access to developer tools or computing resources.
How compromised AI access benefits attackers
An attacker who obtains valid credentials may gain an advantage in three ways:
- Unauthorized access: The attacker may use the compromised account or session within the permissions available to it.
- Resource abuse: Exposed API keys or cloud credentials may allow unauthorized usage charged to the legitimate account owner.
- Further exploitation: Access to developer environments or connected services may expose additional secrets or sensitive information.
Anthropic’s September 2026 threat intelligence report describes a criminal supply chain in which stolen API keys and session tokens are passed to brokers and fraudulent AI resellers. The same report explains that criminals may use compromised credentials for their own operations rather than reselling them.
The broader lesson is that AI access has become a security asset. Protecting it requires more than keeping a subscription password private.
How Infostealer Malware Exposes AI Credentials
Infostealer malware is malicious software designed to collect sensitive information from an infected device. Depending on its capabilities, it may target browser credentials, authentication cookies, session tokens, saved passwords, and application configuration files.
GTIG identified several infostealers whose operators showed interest in AI-related information, including LUMMAC.V2, STEALC.V2, VIDAR, and ACRSTEALER. Its investigation found that attackers were looking beyond traditional browser profiles to AI developer configuration stores.
From browser credentials to authenticated sessions
A password and an authenticated session are not the same thing.
A password is a secret used to authenticate a user. A session token can represent an already authenticated session. If an attacker obtains a valid token and the service accepts it, the attacker may be able to access the account without repeating the normal login process.
This is one reason multifactor authentication (MFA) remains important but is not a complete defense against credential theft. MFA can strengthen the login process, yet it cannot guarantee protection if malware steals an authenticated session after login.
The appropriate response depends on what was exposed. A password change may not be sufficient when active sessions or separate API credentials have also been compromised. Users should follow the affected provider’s procedures for revoking sessions and securing the account.
Why AI developer configuration files matter
GTIG’s findings offer a more specific warning for developers.
In May 2026, the group observed ACRSTEALER operators targeting configuration stores associated with AI coding assistants. The report identified Cline’s secrets.json and Continue AI’s config.yaml as examples of files that may contain plaintext API keys or custom model-routing endpoints.
These files matter because developers sometimes store credentials locally to connect applications to AI models or compatible services. If an attacker obtains a usable key, the risk may extend beyond the developer’s personal account to the associated API quota or infrastructure.
Developers should treat these files as potentially sensitive even when they are not named .env or credentials.json. Secret scanning, access controls, secure storage, and careful handling of local configuration files all help reduce exposure.
How compromised credentials can be reused
Credential theft can create a chain of activity: a device is compromised, sensitive authentication material is collected, the credentials are tested or used, and access may then be resold or incorporated into other operations.
Anthropic reported that some malicious applications disguised as AI tools collected credentials and authenticated session tokens from victims’ devices. It also documented fraudulent reseller operations that used compromised credentials to provide unauthorized AI access.
This makes unofficial AI clients and suspicious offers of unusually cheap access a significant warning sign. A service that asks users to install an unknown application or route their AI traffic through an untrusted intermediary may expose both their credentials and the information they submit.
What Stolen AI Credentials Can Expose
Not all compromised credentials carry the same risk. A stolen consumer account, an exposed API key, and a compromised enterprise cloud identity can provide very different levels of access.
| Access type | Potential exposure | Main concern |
|---|---|---|
| Consumer AI account | Available conversations, profile information, and account functions | Privacy loss and account misuse |
| Session token | Access to an authenticated session, subject to service controls | Unauthorized access without a fresh login |
| API key | Programmatic access permitted by the key | Unauthorized usage, data exposure, and charges |
| Enterprise cloud credentials | Resources allowed by the compromised identity | Broader infrastructure and business compromise |
These are potential outcomes, not proof that every stolen credential exposes all the information listed. Actual impact depends on permissions, service design, account settings, token validity, and connected systems.
Consumer AI account access
A compromised consumer account may expose information available through that account. Depending on the service, this could include saved conversations, profile details, or other account functions.
The attacker might also use the account in ways that violate the provider’s terms or disrupt the legitimate user’s access.
Users should not assume that every AI account grants access to every connected service. The real exposure depends on the account’s permissions and the security controls implemented by the provider.
API keys and unexpected usage charges
An API key is generally used by software to authenticate requests to a service. It is different from a consumer account password, even when both relate to the same AI provider.
If an attacker obtains a valid API key, the attacker may be able to make requests within the key’s permissions and usage limits. Depending on the billing arrangement, this can result in unauthorized consumption or unexpected charges.
Anthropic’s September 2026 report describes criminals obtaining exposed AI API keys and session tokens from applications, websites, public code, and other sources. It also describes cases in which attackers used compromised keys for their own operations.
For developers, the immediate priority after suspected key exposure is to revoke the affected key, issue a replacement through the provider’s approved process, and investigate recent usage. Changing the account password alone does not necessarily invalidate a separate API key.
Enterprise cloud access and LLMJacking
LLMJacking refers to the unauthorized use of compromised cloud or AI resources to run workloads, often at the legitimate owner’s expense.
GTIG documented an April 2026 intrusion in which a threat actor gained access to a victim’s cloud environment through an exposed GitHub personal access token and used that access to deploy unauthorized AI infrastructure and scale high-performance computing resources.
This illustrates why the security implications extend beyond selling consumer AI accounts. A compromised identity may provide access to resources far more valuable than an individual subscription.
Organizations should therefore evaluate the permissions attached to each compromised identity, rather than treating all AI-related credentials as equivalent.
How to Secure Claude, Gemini, and AI Coding Environments
The most effective defense combines account security, endpoint protection, secure credential storage, and monitoring. No single control can eliminate every route to compromise.
Protect consumer AI accounts
Start with the account itself.
- Use a unique, strong password where password authentication is supported.
- Enable MFA or a passkey when the provider offers an appropriate option.
- Secure the email account and recovery methods associated with the AI account.
- Review available security activity and investigate unfamiliar sign-ins.
- Avoid installing unofficial AI applications from untrusted sources.
- Revoke unfamiliar sessions using the provider’s supported security controls.
For Google accounts used with Gemini, Google’s official account security guidance explains how to review account security and manage protective settings.
If an account appears compromised, use the provider’s official recovery process. Do not rely on a third-party service that promises to recover access in exchange for your password, session cookies, or API key.
Protect AI developer credentials
Developers should apply the same care to AI credentials that they apply to production application secrets.
- Store API keys in an approved secrets manager or other secure credential store.
- Avoid committing credentials to source-control repositories.
- Use secret scanning to identify accidental exposures.
- Limit each key’s permissions and access to the resources it actually needs.
- Rotate or revoke exposed keys promptly.
- Review the security of AI coding extensions and integrations before granting access to sensitive projects.
- Keep development devices updated and protected against malicious software.
Configuration files deserve particular attention when they contain plaintext secrets or custom endpoints. A developer may secure the main application repository while overlooking sensitive credentials stored in a local assistant configuration directory.
Protect enterprise AI and cloud environments
For organizations, the response should cover both identity access and resource usage.
Security teams should prioritize least-privilege permissions, centralized identity controls, audit logging, secret scanning, and alerts for unusual API or cloud consumption. Where supported, short-lived credentials can reduce the period during which a stolen credential remains useful.
Organizations should also inventory AI integrations, service accounts, developer tools, and automated agents that can access production data or paid model resources. A forgotten integration can remain an exposure point even after the primary user account has been secured.
What to Do If Your AI Account or API Key Is Compromised
If you suspect your account or credentials have been stolen, prioritize containment before trying to determine every detail of the incident.
1. Secure the affected device. If malware is suspected, stop using the device for sensitive account access until it has been investigated and cleaned. Use a known-clean device for urgent account recovery when possible.
2. Secure the account. Follow the provider’s official recovery process, change an affected password where applicable, and revoke unfamiliar sessions using supported controls.
3. Revoke exposed API keys. Disable compromised keys and create replacements through the provider’s official console. Update legitimate applications that depend on the old keys.
4. Check recent activity. Review sign-ins, API consumption, account changes, and cloud workloads for suspicious activity. Pay particular attention to unexpected usage or billing changes.
5. Investigate the source. Check whether credentials were exposed through malware, source code, a developer configuration file, an unofficial application, or another compromised service.
6. Escalate business incidents. If company data, production credentials, or cloud infrastructure may be involved, notify the responsible security team and follow the organization’s incident-response procedure.
The order may vary with the incident. For example, a company experiencing active unauthorized cloud workloads may need to isolate affected resources and revoke cloud credentials immediately, alongside its investigation.
What the 2026 Reports Establish – and What Remains Unknown
The GTIG findings provide evidence of increased underground demand for AI credentials and growing criminal interest in developer tools and cloud resources. Anthropic’s report independently describes credential theft and unauthorized resale involving AI services. Together, these reports establish a credible security concern.
They do not establish the total number of stolen Claude or Gemini accounts worldwide, the percentage of users affected, or the probability that any particular account has been compromised. Nor does a rise in observed marketplace prices prove that every stolen account has become more valuable.
Those distinctions matter. Underground forum activity offers a view into the criminal economy, but it is not a complete census of compromised accounts. Readers should understand the findings as a warning about the changing value of AI credentials, not as evidence that every user is in immediate danger.
Frequently Asked Questions
1. Why are stolen Claude and Gemini accounts being sold?
Criminals may sell compromised AI access to people seeking premium model capabilities without paying the legitimate cost. Others may use stolen credentials themselves to support cybercrime or access paid computing resources. GTIG’s September 2026 report observed increased buyer demand for Claude and Gemini credentials in the underground forums it tracked.
2. Can someone use a stolen AI account without its password?
Potentially, yes. A valid session token may allow access to an authenticated session without repeating the normal password-based login. Whether this works depends on the service’s security controls and whether the token remains valid. Users who suspect session theft should follow the provider’s guidance for securing the account and revoking active sessions.
3. Does multifactor authentication prevent AI credential theft?
MFA reduces the risk of unauthorized access by adding a verification step beyond a password. However, it cannot guarantee protection against malware that steals an already authenticated session or a separate API key. Effective protection also requires endpoint security, secure credential storage, session management, and prompt revocation of exposed secrets.
4. What is the difference between a stolen AI account and an exposed API key?
A stolen AI account involves unauthorized access to an account and the functions available through it. An exposed API key provides programmatic access according to the key’s permissions. These risks can overlap, but changing an account password may not revoke a separately issued API key. Each compromised credential must be addressed through the appropriate provider controls.
5. What should a developer do after exposing an AI API key?
Revoke the exposed key, issue a replacement, and update applications that legitimately use it. Then review usage logs and billing for unauthorized activity, investigate how the key became exposed, and remove the underlying weakness. If the key was committed to a public repository, assume it may have been copied even if the repository is later made private.
6. Can stolen AI credentials lead to unexpected cloud charges?
Yes, depending on what the compromised credential can access and how the service bills for usage. An exposed API key may permit unauthorized requests, while compromised cloud credentials can potentially enable larger workloads. Organizations should monitor usage and billing, restrict permissions, and investigate unusual consumption promptly.
Protect AI Access Like Any Other Business Credential
The practical lesson from the 2026 reports is straightforward: AI access deserves the same disciplined security treatment as email, source code, and cloud infrastructure. Secure accounts, protect developer secrets, monitor usage, and revoke compromised credentials quickly.
For individual users, start with the security settings of the account you rely on most. For developers and IT teams, review where AI credentials are stored, which applications can access them, and how quickly your organization could revoke them during an incident.
The best response to the growing underground market is not to panic. It is to make stolen credentials less useful before an attacker can exploit them.
Belayet Hossain is a Senior Tech Expert and Certified AI Marketing Strategist. Holding an MSc in CSE (Russia) and over a decade of experience since 2011, he combines traditional systems engineering with modern AI insights. Specializing in Vibe Coding and Intelligent Marketing, Belayet provides forward-thinking analysis on software, digital trends, and SEO, helping readers navigate the rapidly evolving digital landscape. Connect with Belayet Hossain on Facebook, Twitter, Linkedin or read my complete biography.