Hackers are selling stolen Claude and Gemini access at 97% off
The market for stolen AI access has developed a supply chain, a price index and a preferred brand list. Google's threat team has now documented all three — and the discount shoppers get is the loudest number in it.
Access to the frontier models is being resold on dark-web marketplaces at discounts of up to 97% off list, and buyers are bidding hardest for Anthropic's and Google's credentials rather than OpenAI's. The 97% figure comes from the Financial Times, which reported the trade on September 26. Google's own Threat Intelligence Group put the more conservative number in a report earlier this month: the average underground price per AI account more than doubled during 2026, as both buyers and sellers multiplied across the forums it tracks. Crypto Briefing, working from the same research and related vendor data, put typical resale at 40% to 60% off retail — a different discount because it counts a different denominator, API and developer-seat access rather than the $200-a-month consumer subscriptions the FT priced against. Both numbers describe the same shift. AI access has become an asset class with a secondary market, and the ask side of that market is specific.
The mechanics are unglamorous and they are not new. Credential-theft malware does the harvesting. GTIG's analysis of controller commands for infostealers including LUMMAC.V2, STEALC.V2, VIDAR and ACRSTEALER found the operators have moved past scraping AI browser profiles to hunting AI developer configurations directly — one campaign pushed file-grabber rules aimed at the secrets file of Cline and the config file of Continue, both of which can hold plaintext API keys and custom model routing endpoints. Get one and you inherit the victim's paid model quota and, in some cases, their infrastructure.
The second stage is where the money moves, and Google has a worked example. In an April 2026 incident-response case GTIG published, an attacker got into a victim's cloud environment through an exposed GitHub personal access token, then enabled Gemini Enterprise, provisioned NVIDIA RTX 6000 compute, deployed the LiteLLM API and the Manus agent framework behind publicly reachable Cloud Run services, created a rogue service account with Editor privileges, ran BigQuery queries hunting for stored credentials, and finally used Google's own quota API to request more accelerator capacity. They did not steal data and leave. They ran an AI operation on someone else's invoice.
The surrounding data points the same direction. CrowdStrike's 2026 Threat Hunting Report logged an 89% rise in AI-related adversary activity between July 2025 and June 2026. Okta's security team analysed a 7 GB infostealer dump from September 2026 and found hundreds of unexpired tokens tied to AI services. Autonomous agent campaigns compromised infrastructure at 395 organizations across 48 countries that month, and stolen access to more than 30 different LLM providers was being resold underground. The practitioners quoted in the FT's reporting say the opening is widest right now precisely because most companies still do not know how much AI they will consume.
The uncomfortable reading is that the industry solved capability faster than it solved identity. The vulnerability here is not a bug anyone can patch. It is that a subscription sold for one human's convenience, a key a coding assistant leaves in a config file, and a quota API that trusts a service account all fail in the same direction at the same time. Every dollar of stolen capability is margin subtracted from the lab and risk added for whoever ends up paying the bill. For teams running agents, token lifetime, key storage location and per-project quota ceilings are the perimeter now — not the model's refusal behaviour. The industry has spent two years hardening what the model will say. Almost nobody has finished hardening who it is allowed to be.
OpenAI's Codex went down for the better part of an hour on Friday afternoon, and the root cause was a broken service credential on OpenAI's own side. The incident opened at 22:58 UTC on September 25 and was marked critical, hitting four surfaces at once: Codex Web, the Codex API, the CLI and the VS Code extension. Developers logged in through ChatGPT rather than an API key saw 401 Unauthorized errors naming a credential they had never created. OpenAI's status page put its own workaround plainly — logging in with an API key would unblock access — and the incident resolved at 23:54 UTC, just under 56 minutes after it opened. ChatGPT chat itself was never affected, which is the tell: this was a Codex service path, not a model failure.
What makes it worth noting is the shape of the recovery, not the outage. Codex lead Tibo Sottiaux confirmed the fix publicly and said OpenAI would reset usage limits for all paid users across Codex and ChatGPT Work — the industry's current reflex for an outage, paid out in quota rather than refunds. Meanwhile users on the OpenAI developer forum reported residue into the small hours, and the GitHub issue tracker collected duplicates fast enough that OpenAI staff closed them within minutes. A single coding agent going dark for an hour now interrupts the working afternoon of a meaningful slice of the software industry. That dependency is the story, not the 401.
If a stolen key and a broken one can both take a product offline, has the industry been hardening the wrong layer? Tell us in the comments.
Sources: Financial Times · GTIG AI Threat Tracker: From Prompting to Autonomy · Crypto Briefing · Australian Financial Review · OpenAI status page · OpenAI Community thread
