How to protect AI accounts and API keys

Keys and login sessions have become criminal targets. Buy only through official channels, and don't install unknown clients just for a discount.

The report shows that stolen API keys and sessions are themselves stolen goods, resold to fake resale networks or used in attacks.

Takeaways

1. Get services only through official websites and official app stores

'Extra-cheap Claude / GPT access' is a recurring lure in the report.

2. Don't install counterfeit AI coding tools or browser extensions

The report says programs disguised as popular assistants continuously collect new login states on the device.

3. Manage keys like passwords: least privilege, rotatable, never committed to public repos

Production keys in evaluation environments and wrapper services especially need isolation.

4. Enable two-factor authentication offered by the provider, and regularly check login sessions

If you spot unusual usage, revoke the key immediately and follow the official account recovery process.

5. Make it clear within the team who can create keys and where they are used

Reduce the chance of 'someone pasting a production key into a chat'.

{esc(t(CURRENT_LANG, "not_confused_with"))}

{esc(t(CURRENT_LANG, "related_cases"))}

{esc(t(CURRENT_LANG, "sources"))}