Criminals Market Autonomous Scanning Tool Using Stolen AI API Keys

A seller on a restricted criminal forum is marketing an autonomous hacking tool named MONST3R-AI that operates using stolen API keys from OpenAI, Anthropic, and Google. According to Help Net Security, this setup ensures that the owner of the stolen key pays for the computational costs of the scans conducted by the attacker.

Bitsight’s threat intelligence team monitored this shift across thousands of posts on 16 underground forums from February through August 2026. During this period, mentions of AI agents, indirect prompt injection, and the Model Context Protocol (MCP) increased by 67 percent. The tool functions as an autonomous penetration testing platform, allowing buyers to paste stolen keys into a control panel, set a budget cap, and direct the agent toward a specific list of targets.

Autonomous Scanning and Cost Shifting

The seller of MONST3R-AI does not host any large language models themselves. Instead, the tool relies entirely on the external providers’ infrastructure. This design allows the attacker to sidestep the safety training implemented by the AI provider. Because the requests are authenticated with valid, albeit stolen, credentials, the financial charges for the compute time are billed to the victim organization.

The seller claimed the tool generated 1,072 findings across 199 scanned hosts. This figure originates from the seller’s own dashboard and cannot be verified by Bitsight. However, Bitsight notes that even a small portion of accurate findings would render the tool effective for attackers. The firm expects that stolen keys will increasingly be sold specifically to fuel scanners like this one.

Forum Trends and Open-Weights Models

Jailbreaking techniques, which involve getting a model to ignore safety rules, remain the dominant topic on these forums. Discussions about jailbreaking grew by roughly three quarters during the study period. A more significant trend involves skilled actors shifting toward open-weights models such as GLM and DeepSeek. These models can be downloaded and run on rented servers, where no provider monitors requests, keeps logs, or bans accounts.

Forum participants on Chinese- and Russian-language boards now rank models based on their compliance with requests. Some users remove safety behaviors from the models themselves, a technique known as abliteration. Access to these models is inexpensive; a reseller called CloseRouter advertised open-weights and commercial models for around ten cents per million tokens. Its GLM price list showed $0.053 per million input tokens compared to $1.12 from the official API.

What should you do?

Security teams must monitor for unauthorized API key usage and unexpected billing spikes from AI service providers. Organizations should audit their engineering workflows to ensure that agent plugins are not pulled from unverified public registries, which may contain malware disguised as useful tools.

Background: Large language models

Large language models are a specific type of neural network trained on text. Generative AI is the broader umbrella term for any system that creates new content, including images and code. Not all generative AI uses large language models, but most modern text generators do.

Read the full guide: Large Language Models vs Generative AI: The Distinction and Security Implications

What to do and how to stay safe: OpenAI

• Monitor API usage logs and billing statements for unusual spikes or requests originating from unexpected geographies or IP addresses.
• Rotate API keys immediately if there is any suspicion of compromise or if keys are found in unauthorized repositories.
• Implement strict access controls and least-privilege principles for API keys used in development and testing environments.
• Vet third-party plugins and tools from public registries for malware before integrating them into engineering workflows.

Step-by-step guide: Prompt Injection Warning Signs: How to Spot AI Manipulation

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is MONST3R-AI?

MONST3R-AI is an autonomous penetration testing platform sold on criminal forums that uses stolen API keys from OpenAI, Anthropic, and Google to scan targets.

Who pays for the scans conducted by MONST3R-AI?

The owner of the stolen API key pays for the scans, as the tool uses their credentials to access the AI provider’s services.

How did mentions of AI-related attack vectors change in 2026?

According to Bitsight, mentions of AI agents, indirect prompt injection, and the Model Context Protocol rose 67 percent between February and August 2026.