Stolen AI API keys are paying for hackers’ autonomous scans

A seller on a restricted criminal forum is marketing an autonomous hacking tool that runs on stolen OpenAI, Anthropic and Google API keys, so the key’s owner pays for the scans. Bitsight’s threat intelligence team tracked the shift across thousands of posts on 16 underground forums from February through August 2026. Over that window, mentions of AI agents, indirect prompt injection and the Model Context Protocol (MCP) rose 67 percent.

Two groups are exposed. A company that leaks an AI provider key pays for attacks on other people’s systems. An engineering team that pulls agent plugins from public registries can install malware dressed up as a useful tool.

One panel, many stolen keys

The tool, MONST3R-AI, is sold as an autonomous penetration testing platform. The buyer pastes stolen keys into a panel, sets a budget cap and points the agent at a target list. The seller hosts no model of its own. The setup sidesteps the provider’s safety training, and the charges go to the victim.

The seller claimed 1,072 findings across 199 scanned hosts. That number comes from the seller’s dashboard and Bitsight cannot verify it. Bitsight’s position is that even a small accurate share would make the tool effective, and it expects stolen keys to be sold purely to fuel scanners like this one.

Jailbreaks are up, and so are open models

Jailbreaking, getting a model to ignore its safety rules, is still the biggest topic on these forums, and talk about it grew by roughly three quarters over the study period. The more telling change is where the skilled actors are going. Mentions of open-weights models like GLM and DeepSeek climbed sharply. Anyone with these models can download them and run them on rented servers, where no provider is checking requests, keeping logs or banning accounts. Forum members on Chinese- and Russian-language boards now rank models by how easily they go along with requests, and some remove the safety behavior from the model themselves, a technique known as abliteration.

Access is cheap. A reseller called CloseRouter advertised open-weights and commercial models for around ten cents per million tokens, and its GLM price list showed $0.053 per million input tokens against $1.12 from the official API. Mentions of vibe coding more than doubled, though in elite circles the phrase is an insult aimed at people who lean on AI without understanding the code.

Ransomware talk fell by half

The researchers checked the AI numbers against ordinary crime vocabulary on the same forums. AI-related discussion grew 45 percent while ransomware mentions fell 49 percent, and phishing fell 8.5 percent. Takedowns and moves to closed channels likely explain part of the ransomware drop, so some of the gap is attention shifting between topics.

Branded criminal chatbots such as WormGPT and FraudGPT slipped 8.7 percent, close to the phishing decline. WormGPT was breached earlier this year, exposing roughly 19,000 users’ emails, payment data and subscription tiers.

What you should check

Forum members are dissecting FakeGit, a campaign attributed to the actor Water Kurita in which roughly 7,600 fraudulent GitHub repositories spread SmartLoader malware. More than 800 posed as AI skills or MCP servers, including a lookalike “Docker MCP Gateway,” to get indexed in public AI registries. In other posts, one actor showed an agent using the IDA Pro disassembler to find a buffer overflow and draft an exploit plan, and another used a browser-automation agent to breach an enterprise Notion account.

Scan for exposed AI provider keys and treat a leak as seriously as an exposed AWS credential. Verify the source of every MCP server and agent plugin. Block local coding agents from sensitive directories and shell commands without human approval. Baseline human login rates on Notion, Slack and GitHub, since agents driving headless browsers work at a distinct cadence.

Download: The IT and security field guide to AI adoption