Verify AI Key Usage Immediately to Stop Criminals From Using Your Budget for Scans
Criminals are using stolen API keys from major providers to run autonomous scanning tools, forcing the key owners to pay for the attack costs.
Key points
- Bitsight tracked a 67 percent rise in mentions of AI agents and indirect prompt injection on underground forums from February to August 2026.
- The MONST3R-AI tool allows buyers to input stolen OpenAI, Anthropic, or Google keys to conduct autonomous penetration tests at the victim's expense.
- Forum discussions about jailbreaking models grew by roughly three quarters during the study period, while interest in open-weights models also climbed sharply.
An autonomous hacking tool marketed on restricted criminal forums is using stolen API keys from OpenAI, Anthropic, and Google to conduct scans, ensuring the key owner pays for the activity. Bitsight’s threat intelligence team observed this trend across thousands of posts on sixteen underground forums between February and August 2026.
The tool, known as MONST3R-AI, operates as an autonomous penetration testing platform that sidesteps provider safety training by utilizing compromised credentials. Buyers paste stolen keys into a control panel, set a budget cap, and target specific hosts. The seller does not host any models, meaning all computational charges are billed directly to the victim whose keys were stolen.
Market Dynamics and Threat Evolution
Bitsight researchers noted that mentions of AI agents, indirect prompt injection, and the Model Context Protocol rose by 67 percent during the six-month window. Jailbreaking remained the dominant topic, with discussions growing by approximately three quarters. However, skilled actors are increasingly turning to open-weights models like GLM and DeepSeek, which can be downloaded and run on rented servers without provider oversight or logging.
Forum participants on Chinese- and Russian-language boards are ranking models by their compliance with requests. Some users are performing abliteration, a technique that removes safety behaviors from the model themselves. This shift allows attackers to operate outside the constraints of commercial API safety filters and account bans.
Affected Parties and Financial Impact
Two distinct groups face exposure from this activity. Companies that leak AI provider keys are forced to pay for attacks conducted against other people’s systems. Additionally, engineering teams that pull agent plugins from public registries risk installing malware disguised as useful tools. The seller claimed 1,072 findings across 199 scanned hosts, though Bitsight cannot independently verify these numbers from the seller’s dashboard.
Access to these models is inexpensive. A reseller called CloseRouter advertised open-weights and commercial models for around ten cents per million tokens. Its price list showed GLM input tokens at $0.053 per million, compared to $1.12 from the official API. This cost differential incentivizes the use of stolen keys to avoid even these low fees while shifting the financial burden to the victim.
What to watch
Monitor API billing statements for unusual spikes in usage or requests originating from unexpected geographic locations. Watch for new forum discussions regarding indirect prompt injection techniques and the Model Context Protocol, as these vectors are gaining traction. Be alert for changes in how open-weights models are distributed, particularly if they appear in public plugin registries without proper verification.
What made it possible
This activity relies on the fundamental weakness of API key authentication, which grants broad access to computational resources without verifying the intent of the request. Attackers exploit the lack of granular controls that tie specific keys to authorized use cases or user identities. This technique serves the initial access and resource acquisition stages of an intrusion, allowing criminals to leverage victim infrastructure for scanning. Teams usually implement strict key rotation and usage limits to mitigate this risk.
Background: Threat intelligence program
A threat intelligence program is a systematic process of collecting, analyzing, and acting on data about potential adversaries. It solves the problem of alert fatigue by providing context, helping you prioritize risks that specifically target your industry and technology stack before an attack occurs.
Read the full guide: Threat Intelligence Programs: Definition, Purpose and Core Components
What to do and how to stay safe: OpenAI
- Audit all active API keys for OpenAI, Anthropic, and Google services to ensure they are only used in authorized applications.
- Set strict budget caps and usage alerts on all API accounts to detect anomalous consumption patterns immediately.
- Review plugin sources for AI agents to ensure they come from trusted, verified vendors rather than open public registries.
- Implement network monitoring to identify outbound connections to AI provider endpoints that do not match expected business workflows.
Step-by-step guide: How Security Advisories Drive Patch Decisions and Reduce Risk
General security guidance from the Shell Bulletin newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which AI providers are having their keys stolen for this tool?
The tool uses stolen keys from OpenAI, Anthropic, and Google.
How much did mentions of AI agents rise on underground forums?
Mentions of AI agents, indirect prompt injection, and the Model Context Protocol rose 67 percent from February to August 2026.
Can Bitsight verify the number of findings claimed by the seller?
No, Bitsight cannot verify the seller’s claim of 1,072 findings across 199 scanned hosts.
