The Wall Street Journal ran a story this week with a headline that sums up where we are: hackers are hunting for AI’s most valuable commodity, computing power. None of it surprised me. What still gets me is how ordinary the way in is. Most of the time nobody breaks anything. They find a key.
Compute is the new loot
For years the payoff from breaking into a cloud account was crypto mining. Find a leaked AWS key, spin up a pile of GPUs, mine until somebody notices the bill. The play hasn’t changed much. What changed is what the stolen capacity is worth. GPUs are scarce, rental prices keep going up, and the top tier of ChatGPT or Claude can run $200 a month per seat. Stolen access is now worth reselling.
Google’s threat intelligence team has been watching this grow all year. John Hultquist, their chief analyst, told the Financial Times in September that “what we’re seeing in the underground market is an economy that’s growing around access to AI.” Google found marketplaces selling access to Anthropic, Google and OpenAI models at up to 97% off, some with a promise to replace a banned account for free. People call it LLMjacking.
Hultquist made another point I keep thinking about. Attackers get the compute for next to nothing, and defenders pay full price. And a company that just switched on a new AI workload already has a usage graph going straight up, which is great cover for someone else’s jobs.
Almost all of it starts with a key
Take away the scary framing and the usual path is boring. Somebody has an OpenAI key, an Anthropic key, a cloud access key or a service account file. It ends up in a .env that gets committed, a Docker image, a CI log, a Slack thread, or a GitHub issue where someone pasted it while asking for help. Bots scrape public repos all day and find these in minutes. After that the key gets sold, or used directly until the invoice shows up.
Agents make it worse. An agent that calls a model needs a key. A coding agent reads your project, .env included, and will print a file to debug it without thinking twice. Now your key is sitting in a transcript on someone else’s servers.
Make your keys worth less to steal
You can’t make a key impossible to steal. You can make a stolen one close to worthless, and you can keep most of your systems from ever holding one. That’s what we built 1Claw to do.
The provider key stays in the vault
With Shroud, our LLM proxy, your OpenAI or Anthropic key lives in an HSM-backed vault. Your agents and apps call models through Shroud, and Shroud attaches the real key on the way out. If one of those machines gets popped, there’s no provider key on it to sell.
Every key you hand out has a ceiling
Shroud router keys work with the stock OpenAI and Anthropic SDKs. You change the base URL and the key and that’s it. Each router key can carry a spend cap, and each agent can have a daily budget, a requests per minute limit and a list of models it’s allowed to use. A key that can spend $20 a day on one model isn’t much of a product on a dark web market. If one leaks, you revoke it and it stops working within a minute.
No long-lived keys where we can avoid them
1Claw is an OIDC identity provider, so an agent can get short-lived credentials from Anthropic through workload identity federation, with nothing static on disk. Agent sessions on 1Claw itself run on tokens that expire after 15 minutes.
Get the .env out of reach
1claw ignore encrypts your local env files and writes the ignore rules for Claude Code, Cursor and the other coding agents. 1claw env import moves the values into your vault without printing them. For third party APIs, 1claw agent binding proxy gives your app a local proxy token, and the real credential never leaves the vault.
Find out when someone else is using it
Every secret read and every model call is logged. Our Risk Engine flags impossible travel and trips on honeytokens, which are keys that should never be used by anyone. So you hear about a leak when the key gets used, not three weeks later when the bill comes.
What a vault won’t fix
I want to be straight about this part. If someone already has admin on your cloud account, a vault won’t save you. They can run GPUs on your bill whether your model keys are safe or not. Lock down cloud IAM, turn on billing alerts, and treat a sudden jump in GPU spend like an incident. What we can do is shrink the pile of long-lived credentials that gets people in the door, including the cloud credentials your agents use. Those can sit in the vault behind a binding too, instead of in a config file.
Where I’d start this week
If you run anything that talks to a model, search your repos, images and CI logs for strings starting with sk- and sk-ant-. Rotate whatever you find. Then move the provider key into a vault and put a proxy with a budget in front of it. On 1Claw that’s an afternoon: sign up, add your provider key, and point your SDK’s base URL at Shroud.
Compute is going to stay scarce for a while, so people will keep hunting for it. Your keys just shouldn’t be worth finding.