Detects creation of durable admin API keys for Anthropic, which grant programmatic organization/compliance access outside an interactive browser session. The rule inspects Anthropic audit logs (anthropic.audit) for events categorized under IAM with action 'admin_api_key_created'. Admin keys can survive user session revocation (password resets, IdP lockouts) and enable automated exports, role grants, and logging changes if not revoked. The rule is mapped to MITRE ATT&CK T1098 (Account Manipulation) with subtechnique T1098.001 (Additional Cloud Credentials) under Persistence (TA0003). Investigation fields are enriched (admin_api_key_id, scopes, actor identity, source IP, user agent, organization) to support rapid containment and attribution. False positives may occur when keys are legitimately created during onboarding or rotation; verify against inventory and change tickets. Suggested triage steps include correlating key creation with admin activity, reviewing whether the actor is known to have elevated privileges, and revoking unauthorized keys while auditing related exports and SSO changes. Remediation emphasizes revoking the key in Anthropic, rotating other admin credentials, and reviewing activity tied to the key across the exposure window. References include the Anthropic API compliance activities API docs.