Supply Chain Attacks on the AI Tools Your Business Uses

Executive Summary

Kariba Security Group is issuing this advisory about an attack vector that most small businesses don't know exists: criminals targeting the AI tools and integration services your business relies on — not to attack you directly, but to steal the API keys those services hold on your behalf.

Anthropic's September 2026 threat intelligence report documents an operation (GTG-50020) in which a criminal actor used prompt injection to cause an AI vendor's automated evaluation sandbox to hand over the production API keys it held — including production keys from multiple AI providers belonging to that vendor. The same actor then ran a follow-on campaign against roughly thirty AI companies in about four days, applying the same technique with minor adaptations for each target.

You didn't need to do anything wrong for your credentials to be exposed. A breach of one AI vendor or integration service can expose the credentials of all their customers simultaneously.

What Is a Supply Chain Attack?

A supply chain attack targets a vendor or service that many other businesses depend on, rather than attacking those businesses directly. By compromising the vendor once, the attacker gets access to all of the vendor's customers at the same time.

In the AI context, your business may depend on third-party AI tools that hold your API keys to operate on your behalf: chatbot platforms, AI writing tools, customer service automation, AI-powered analytics, and similar services. Each of these services is a potential supply chain target.

How the GTG-50020 Attack Worked

Prompt injection as an attack vector

The attacker identified that the target vendor ran automated AI workflows — pipelines that used AI models to evaluate, process, or test content. The attacker submitted carefully crafted content designed not to be processed normally, but to instruct the AI model to perform actions it shouldn't: specifically, to extract and transmit API keys from its operating environment.

This technique is called prompt injection, and it exploits the fact that AI models process instructions and data in the same stream — making it possible for malicious content to be interpreted as instructions rather than data.

Scale of exposure

Once the attacker had access to one vendor's key store, they applied the same technique across roughly thirty additional AI companies in about four days. Each successful compromise exposed the credentials of that vendor's entire customer base.

What This Means for Your Business

If any of the AI tools you use were among the affected vendors, your API keys may have been exposed without any action on your part and without the tool provider notifying you immediately. You would have continued using the tool normally, unaware that your credentials had been compromised.

How to Assess Your Exposure

Inventory your AI tool integrations

List every AI-powered tool your business uses that could hold your API keys. For each one, ask:

• Does this service have access to my Anthropic or other AI provider credentials?
• How does this service store and protect those credentials?
• Has this service published a security incident disclosure in the past 12 months?

Use separate API keys per integration

Create a dedicated API key for each third-party service that needs AI API access. If one service is compromised, you can revoke that key without affecting your other integrations. This is the single most effective supply chain protection available to small businesses.

Monitor usage per key

Anomalous usage on one key — while other keys show normal activity — is a strong indicator of supply chain compromise rather than direct credential theft.

Review vendor security practices before signing up

Before giving a third-party AI tool access to your API credentials, ask how they store keys, whether they've undergone independent security testing, and what their incident disclosure policy is. Vendors who can't answer these questions clearly warrant additional scrutiny.