Anthropic report: stolen token became cloud admin in 3 hours

A stolen developer token turned into full cloud admin access in about three hours. That's the finding in Anthropic's threat intelligence report, which covers December 2025 through August 2026.

The gap that matters is between how fast identity theft moves now and how slow most credential rotation still is. ShinyHunters affiliates used what the report calls "vibe hacking" to escalate from a single token to admin rights, then spread to more than 200 downstream organizations. In a separate case in the same report, operators pulled more than 2,100 Azure AD tokens from over 40 tenants in about 34 hours.

Three hours to full admin, starting from one token. Any org still issuing API keys or session tokens that outlive a workday is exposed to that math.

The report also names GTG-10007, a Chinese group that ran agent swarms with persistent memory across campaigns. Thirteen standing collection agents worked on a schedule and produced more than a dozen candidate zero-days in a month, a pace of vulnerability research that used to need a much bigger human team.

Several of the cases in the report name Claude Code as the tool used to build the exploitation frameworks. Anthropic is describing its own product's role in facilitating these attacks.

After a report like this, short-lived credentials stop being optional. If a stolen token can become admin in three hours, a token that lives longer than three hours is the exposure. Rotate on hours, not weeks, and assume agent-built tooling is already probing for the ones that don't.