Case · DiggingBeagle record
Anthropic reports that a financially motivated actor injected malicious instructions into an AI vendor's automated evaluation sandbox, stole production API keys and then used agentic workflows against roughly 30 AI companies in about four days.
Anthropic's GTG-50020 case study. The affected AI vendor is not named in the public report, and Anthropic states that its own systems were not compromised.
GTG-50020 is useful because the AI system was both a target and an attack accelerator. Anthropic reports that the actor placed malicious instructions into an AI vendor's automated evaluation sandbox. The sandbox returned credentials it held, including production API keys for multiple AI providers.
The operator then used those stolen keys to continue intrusion attempts and shifted workloads onto victim credentials. Anthropic says a follow-on campaign from the same infrastructure attacked roughly 30 AI companies in about four days. The operator combined human-directed scope files with parallel reconnaissance and exploitation agents, plus a containerized open-source pentest platform that ran exploitation loops against production systems.
The campaign's stated ambition included access to a pre-release Claude model. Anthropic says that goal failed and that Anthropic's own systems were not compromised.
The actor targets a system that consumes untrusted evaluation material.
Boundary: attacker input / AI evaluation sandbox
The automated environment hands over production AI API keys available inside it.
Boundary: sandbox / production credentials
The actor uses victim credentials for subsequent model access and attack automation.
Boundary: stolen credentials / AI provider
Scope files and worker agents perform reconnaissance, exploitation and retesting across many targets.
Boundary: operator / agentic pentest pipeline
The operator adapts the same successful path across roughly 30 targets.
Boundary: validated exploit path / target fleet
Anthropic's indicator table begins on May 21 for infrastructure associated with the case.
The report describes prompt injection against an AI vendor and the follow-on AI-company campaign.
Locator: GTG-50020, follow-on campaign
The report states that roughly 30 AI companies were attacked in about four days.
Locator: GTG-50020, AI supply-chain intrusion
Anthropic describes prompt injection against an automated evaluation sandbox and theft of production API keys.
Locator: GTG-50020, human-directed loop and autonomous exploitation pipeline
Anthropic describes worker agents testing and exploiting production web applications without step-by-step human supervision.
Locator: GTG-50020, campaign objective
The report says attempts to reach a pre-release Claude model failed and Anthropic systems were not compromised.
diagram
Prompt injection targets automated sandbox
Holds production provider credentials
Victim credentials become compute and cover
Reconnaissance and exploitation loops
Roughly 30 companies in follow-on campaign
Evaluation sandboxes should be treated as credential-bearing production dependencies. Prompt injection against an automated evaluator can become credential theft if the sandbox has access to provider keys. Once those keys are stolen, they can finance and disguise the next attack loop.
DiggingBeagle. “GTG-50020 used prompt injection against an AI evaluation sandbox.” First seen May 21, 2026. https://diggingbeagle.com/cases/gtg-50020-used-prompt-injection-against-an-ai-evaluation-sandbox/
Citation guidanceWhy this archive exists
DiggingBeagle is a non profit research project documenting AI security incidents, agent failures, vulnerabilities and AI-assisted operations. A case keeps its claims beside the sources that support, contest or limit them. Later updates stay visible, so a reader can see when the account changed.
We publish case reconstructions, dated reporting and analysis across records. Each has a different evidentiary role. About the project and our methodology explain how the work is reviewed.