Anthropic's $16.8B Revenue Surge Signals Enterprise AI Sprawl — Shadow AI Detection and LLM Security Controls for Defenders

Anthropic has reportedly told investors that quarterly revenue jumped nearly 50% to approximately $16.8 billion ahead of an anticipated IPO, according to reporting covered by Simon Willison. On its face this is a business story. For defenders, it is a threat intelligence story.

Revenue growth of that magnitude is not coming from consumer chatbots — it is coming from enterprise API consumption, embedded AI features in SaaS platforms, autonomous agent deployments, and Model Context Protocol (MCP) integrations inside your environment. Every one of those dollars represents credentials issued, data egressed to external inference endpoints, and agentic processes running with delegated permissions — much of it provisioned by business units without security review. Shadow AI is now what shadow IT was in 2012, except the data exposure surface is far larger: prompts routinely contain source code, customer records, credentials, and regulated data.

If Anthropic's growth curve is accurate, the majority of organizations reading this have undeployed, unmonitored, or ungoverned AI API traffic right now. This post is about finding it, constraining it, and building the detection layer before your incident responders are reconstructing a data-leak timeline from logs nobody kept.

Technical Analysis: The Shadow AI Attack Surface in 2026

The defensive problem decomposes into four observable surfaces, all of which map directly to Anthropic-scale enterprise adoption:

1. Unsanctioned API Consumption

Anthropic's production API endpoint is api.anthropic.com (and for enterprise deployments, AWS Bedrock via bedrock-runtime.*.amazonaws.com and Google Vertex AI endpoints). Any process on a corporate endpoint or server establishing TLS sessions to these destinations outside an approved integration list is shadow AI by definition. The complicating factor in 2026 is that AI capability is now embedded inside sanctioned SaaS — your code editor, your ticketing system, your SIEM may all call Claude under the hood. Distinguishing first-party embedded calls from rogue employee-driven usage requires process-level attribution, not just DNS filtering.

2. Credential Proliferation

Anthropic API keys (sk-ant-... prefix format) are proliferating through the same channels cloud keys did: hardcoded in source repositories, committed to GitHub and GitLab, stored in plaintext dotfiles, embedded in CI/CD variables without rotation, and pasted into third-party "AI wrapper" tools of unknown provenance. A leaked key is not just a billing problem — depending on scoping and workspace configuration, it can expose conversation history, files uploaded to projects, and in agentic configurations, whatever downstream systems the agent could reach.

3. MCP Server Sprawl

The Model Context Protocol — Anthropic's open standard for connecting AI models to tools and data sources — has seen explosive adoption through 2025 and 2026. MCP servers run as local processes (frequently spawned via npx, uvx, or docker from Claude Desktop, Cursor, and similar clients) and are routinely granted filesystem access, database credentials, shell execution, and internal API reach. Community-maintained MCP servers of unknown security posture are being installed at scale with npx -y <package> one-liners that pull and execute remote code with the user's full privileges. This is a supply-chain surface that most EDR policies treat as benign developer tooling.

4. Agentic Delegation

Claude-powered agents are being granted OAuth tokens, browser sessions, and tool-use permissions to act on behalf of users. The blast radius of a prompt injection against an agent with mailbox, filesystem, and SaaS write access is categorically different from a chatbot leak. Indirect prompt injection via poisoned documents, emails, and web pages remains the dominant technique against tool-using agents, and there is no patch for it — only architectural containment.

Detection & Response

The following detections assume a mature telemetry posture (Sysmon or equivalent process creation logging, DNS/proxy logging, and EDR network connection events). They are tuned to fire on deviation from an approved baseline — you must populate the allowlists with your sanctioned integrations first, or these will be noise.

Sigma Rules

---
title: Unsanctioned Process Connecting to Anthropic API Endpoint
id: 3f9a1c42-7b8e-4d21-9a5f-2e6c8d1a4b07
status: experimental
description: Detects non-browser, non-allowlisted processes establishing network connections to Anthropic's API endpoint, indicating shadow AI usage or unauthorized embedded integrations.
references:
  - https://attack.mitre.org/techniques/T1071/001/
  - https://attack.mitre.org/techniques/T1552/001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationHostname|contains:
      - 'api.anthropic.com'
      - 'claude.ai'
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
      - '\Claude.exe'
  filter_approved_tools:
    Image|endswith:
      - '\Code.exe'
      - '\cursor.exe'
  condition: selection and not 1 of filter_*
falsepositives:
  - Sanctioned developer IDE integrations (populate filter_approved_tools with your approved list)
  - Legitimate Claude Desktop usage where corporate policy permits it
level: medium
---
title: MCP Server Spawned via Package Runner with Remote Fetch
id: 8c2d5e91-4a6f-4b38-8c1d-9e7f2a5b3d46
status: experimental
description: Detects npx, uvx, or docker run invocations that fetch and execute MCP server packages on demand — a common shadow AI installation pattern that executes remote code with user privileges.
references:
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1195/002/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.supply_chain_compromise
  - attack.t1195.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\npx.cmd'
      - '\npx.exe'
      - '\uvx.exe'
      - '\docker.exe'
  selection_cli:
    CommandLine|contains:
      - 'mcp-server'
      - 'server-mcp'
      - '@modelcontextprotocol'
      - '-y '
  condition: selection_img and selection_cli
falsepositives:
  - Approved MCP deployments by engineering teams — baseline by package name and parent process
level: medium
---
title: Anthropic API Key Pattern Written to Disk or Process Command Line
id: 5b1e7a38-2c4d-4f96-b3a8-6d9e1c7f2a54
status: experimental
description: Detects the Anthropic API key prefix (sk-ant-) appearing in process command lines, indicating keys passed as arguments (visible to any local user via process enumeration) rather than loaded from secure secret stores.
references:
  - https://attack.mitre.org/techniques/T1552/001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1552.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'sk-ant-'
      - 'ANTHROPIC_API_KEY'
falsepositives:
  - Developer environments setting keys inline — treat as a policy violation worth surfacing, not an attack
level: low

KQL — Microsoft Sentinel / Defender

This hunt identifies endpoints and processes communicating with Anthropic infrastructure that are not on your sanctioned integration list, and separately hunts for MCP package-runner executions across the fleet. It assumes Defender for Endpoint tables; if you ingest proxy/DNS via CEF, substitute CommonSecurityLog accordingly.

// Part 1: Network connections to Anthropic endpoints from non-browser processes
let ApprovedAIProcesses = dynamic(["Code.exe", "Claude.exe", "cursor.exe"]);
let BrowserProcesses = dynamic(["chrome.exe", "msedge.exe", "firefox.exe", "brave.exe"]);
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteUrl has_any ("api.anthropic.com", "claude.ai", "anthropic.com")
   or RemoteIP in ("160.79.104.0/24")  // verify current Anthropic egress ranges before use
| extend ProcessName = tostring(split(InitiatingProcessFileName, @"\")[-1])
| where ProcessName !in~ (ApprovedAIProcesses) and ProcessName !in~ (BrowserProcesses)
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),
    ConnectionCount = count(), RemoteIPs = make_set(RemoteIP),
    Users = make_set(InitiatingProcessAccountName)
  by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by ConnectionCount desc;

// Part 2: MCP server installations via package runners (Defender process events)
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ ("npx.cmd", "npx", "uvx", "docker", "uv")
| where ProcessCommandLine has_any ("mcp", "@modelcontextprotocol")
| extend ParentName = tostring(split(InitiatingProcessFileName, @"\")[-1])
| summarize FirstSeen = min(TimeGenerated), ExecCount = count(),
    Commands = make_set(ProcessCommandLine, 25)
  by DeviceName, AccountName, ParentName
| order by ExecCount desc;

// Part 3: Anthropic API keys exposed on process command lines
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where ProcessCommandLine has "sk-ant-"
| project TimeGenerated, DeviceName, AccountName, FileName,
    ProcessCommandLine, InitiatingProcessFileName
| order by TimeGenerated desc;

Velociraptor VQL

Use this artifact to sweep the fleet for processes currently holding Anthropic API keys in their environment or command line, and for MCP configuration files in user profiles (Claude Desktop, Cursor, and VS Code all persist MCP server definitions to JSON files — those files are your shadow AI inventory).

-- Hunt: Enumerate MCP client configurations and processes with exposed Anthropic credentials
LET mcp_configs = SELECT FullPath, Size, Mtime,
    read_file(filename=FullPath, length=65536) AS ConfigSnippet
  FROM glob(globs=[
    'C:/Users/*/AppData/Roaming/Claude/claude_desktop_config.json',
    'C:/Users/*/.cursor/mcp.json',
    'C:/Users/*/.vscode/**/mcp.json',
    'C:/Users/*/AppData/Roaming/Code/User/**/mcp.json',
    '/home/*/.config/Claude/claude_desktop_config.json',
    '/home/*/.cursor/mcp.json',
    '/Users/*/Library/Application Support/Claude/claude_desktop_config.json'
  ])

SELECT * FROM mcp_configs
UNION ALL
SELECT Exe AS FullPath, Pid AS Size, CreateTime AS Mtime,
    CommandLine AS ConfigSnippet
FROM pslist()
WHERE CommandLine =~ 'sk-ant-|ANTHROPIC_API_KEY|mcp-server|@modelcontextprotocol'

Remediation Script — Shadow AI Inventory and Key Exposure Check

Run this via your RMM or as a scheduled GPO/Intune script to build a fleet-wide inventory of AI client installations, MCP configurations, and exposed Anthropic credentials. It changes nothing — it reports. Remediation decisions belong with your governance process.

#requires -RunAsAdministrator
# Shadow AI Discovery: Anthropic clients, MCP configs, and exposed API keys
# Output: JSON per-host inventory for central collection

$report = [ordered]@{
    Hostname        = $env:COMPUTERNAME
    ScanTime        = (Get-Date).ToUniversalTime().ToString('o')
    MCPConfigs      = @()
    ExposedKeys     = @()
    AIProcesses     = @()
    DnsHitsCached   = @()
}

# 1. Locate MCP client configuration files across user profiles
$mcpPaths = @(
    'C:\Users\*\AppData\Roaming\Claude\claude_desktop_config.json',
    'C:\Users\*\.cursor\mcp.json',
    'C:\Users\*\AppData\Roaming\Code\User\mcp.json'
)
foreach ($pattern in $mcpPaths) {
    Get-ChildItem -Path $pattern -ErrorAction SilentlyContinue | ForEach-Object {
        $content = Get-Content $_.FullName -Raw -ErrorAction SilentlyContinue
        $report.MCPConfigs += [ordered]@{
            Path        = $_.FullName
            LastWrite   = $_.LastWriteTime.ToString('o')
            HasApiKey   = ($content -match 'sk-ant-')
            Servers     = ([regex]::Matches($content, '"([\w\-\.]+)":\s*\{') |
                           ForEach-Object { $_.Groups[1].Value }) -join ','
        }
    }
}

# 2. Find running processes with Anthropic keys on the command line (visible to all local users)
Get-CimInstance Win32_Process | Where-Object {
    $_.CommandLine -match 'sk-ant-|ANTHROPIC_API_KEY'
} | ForEach-Object {
    $report.ExposedKeys += [ordered]@{
        PID     = $_.ProcessId
        Name    = $_.Name
        User    = (Invoke-CimMethod -InputObject $_ -MethodName GetOwner).User
        # Never log the key itself - record only that it exists
        KeyRef  = 'sk-ant-' + ($_.CommandLine -replace '.*sk-ant-(.{6}).*', '$1') + '...'
    }
}

# 3. Identify active connections to Anthropic infrastructure
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
    Where-Object { $_.RemotePort -eq 443 } | ForEach-Object {
        $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        try {
            $host_ = [System.Net.Dns]::GetHostEntry($_.RemoteAddress).HostName
        } catch { $host_ = $null }
        if ($host_ -match 'anthropic|claude') {
            $report.AIProcesses += [ordered]@{
                Process = $proc.ProcessName
                Path    = $proc.Path
                Remote  = "$($_.RemoteAddress) ($host_)"
            }
        }
    }

# 4. Check DNS cache for recent Anthropic resolution (indicates recent usage)
Get-DnsClientCache -ErrorAction SilentlyContinue |
    Where-Object { $_.Entry -match 'anthropic|claude\.ai' } |
    ForEach-Object { $report.DnsHitsCached += $_.Entry }

$report | ConvertTo-Json -Depth 4

Remediation

There is no patch for organizational sprawl — this is a governance and architecture problem. Execute in this order:

1. Establish the inventory (this week). Deploy the discovery script and VQL artifact above. You cannot govern what you have not enumerated. Expect to find AI clients and MCP servers you did not approve; that is the point.

2. Rotate and re-home exposed credentials. Every sk-ant- key found on a command line or in a plaintext config file should be treated as compromised: revoke it in the Anthropic Console (https://console.anthropic.com → API Keys), then re-issue through your secrets manager (HashiCorp Vault, Azure Key Vault, AWS Secrets Manager). Enforce short-lived keys where the platform supports workspace-scoped TTLs. Add sk-ant- to your Git pre-commit scanning (gitleaks, trufflehog) and CI/CD secret detection immediately — Anthropic keys are not in every scanner's default ruleset.

3. Egress control with an approved-integration model. Block api.anthropic.com at the proxy for server VLANs and general user segments; permit it only from documented application identities via a forward proxy with TLS inspection where legally permissible. Route sanctioned enterprise usage through AWS Bedrock or Google Vertex AI where possible — this collapses AI traffic into your existing cloud governance, logging (CloudTrail), and DLP controls instead of a direct vendor relationship per employee.

4. MCP allowlisting. Publish an approved MCP server catalog. Block npx -y-style on-demand package execution for non-developer endpoints via AppLocker or WDAC. For approved MCP servers, pin package versions and hashes — the npx -y <package> pattern pulls latest on every launch, which is an unpinned supply-chain dependency executed with user privileges. Require filesystem-scoped MCP servers to use read-only modes unless write access is justified in writing.

5. Data egress guardrails. Extend DLP policies to cover AI endpoints specifically: prompt bodies and file uploads to api.anthropic.com should be inspected for regulated data classes (PHI, PCI, source code markers) the same way you inspect uploads to personal cloud storage. If your DLP vendor still treats AI endpoints as generic HTTPS, that is a gap to raise now.

6. Agent containment. Any agentic deployment (Claude with tool use, computer use, or MCP-connected agents) must run under a dedicated service identity with least-privilege OAuth scopes, a human-approval gate for destructive or external-facing actions, and full tool-call logging retained to your SIEM. Assume indirect prompt injection will succeed eventually and design so that success is boring.

7. Policy that matches reality. A blanket "no AI" policy will fail — Anthropic's revenue curve proves your users have already routed around it. Publish a fast-track approval path (days, not quarters) for AI tool requests, a clear data-classification matrix for what may enter prompts, and consequences only for concealment, not for asking.

The organizations that will handle the next AI-driven incident well are the ones building this visibility layer now — while adoption is still outpacing attackers' monetization of it. That window does not stay open long.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub