Hackers Use Stolen AI API Keys to Fund Autonomous Scans

Oct 18, 2026
A tool sold on a criminal forum uses stolen OpenAI, Anthropic and Google API keys to run autonomous security scans while charging the key owners.

A seller on a criminal forum is offering an autonomous hacking tool that runs on stolen API keys from OpenAI, Anthropic and Google, according to threat intelligence research by Bitsight reported by Help Net Security. The tool charges scanning costs to the owners of the compromised keys.

MONST3R-AI lets buyers enter stolen keys, choose a spending limit and provide a target list. The seller claimed the tool found 1,072 issues across 199 hosts, but Bitsight could not verify those figures.

Bitsight examined thousands of posts across 16 underground forums from February through August 2026. Mentions of AI agents, indirect prompt injection and the Model Context Protocol rose 67 percent during that period.

The researchers also identified more than 800 fraudulent GitHub repositories that posed as AI skills or MCP servers while distributing SmartLoader malware. Bitsight recommends scanning for exposed AI provider keys, verifying agent plugins and MCP servers, and requiring human approval before coding agents access sensitive directories or run shell commands.

We hope you enjoyed this article

Consider subscribing to one of our newsletters like Cybersecurity AI Weekly or Daily AI Brief.

Also, consider following us on social media:

Cybersecurity AI AI Brief AI Brief (X)
Free newsletter

Cybersecurity AI Weekly

Weekly newsletter about AI in Cybersecurity.

AI Token Webinar

Whitepaper

Tensordyne Napier: What If One Rack Could Do the Work of Nine?

Tensordyne

This Tensordyne whitepaper presents Napier, an inference-focused AI processor and rack-scale system based on the company’s TDN Math logarithmic number system. It examines infrastructure requirements for large mixture-of-experts and agentic models, compares major inference architecture approaches, and details the TDN AIP processor, TDN72 pod, TDN Link fabric, and Napier Ultra configuration. The paper reports simulation-based performance, cost, and accuracy-validation results, including Tensordyne’s projected comparison of one Napier rack with a nine-rack Nvidia Rubin plus Groq deployment; the chip is reported as taped out and in fabrication.

Read more

You may also like

Free, six days a week

Daily AI Brief: the AI news that matters, in your inbox.