Hackers Are Running Autonomous Attack Scans on Other People's AI Accounts, Bitsight Finds
A criminal tool called MONST3R-AI is sold to attackers who plug in stolen OpenAI, Anthropic and Google keys, so the victim pays for every scan, according to Bitsight.
Outspoken Digest Technology Desk
Sunday, October 18, 2026/2 min read
The newest way to steal from a company involves no ransom note. A forum seller is marketing an autonomous hacking agent that has no model of its own: it borrows yours, and sends you the invoice.
Security firm Bitsight described the tool, MONST3R-AI, in research published on 16 October, as covered by Help Net Security. It is sold on a restricted criminal forum as an autonomous penetration-testing platform. The buyer enters stolen API keys for OpenAI, Anthropic or Google, sets a budget and points the agent at targets. The seller hosts nothing, and whoever owns the keys pays the charges.
How does MONST3R-AI work?
According to Let's Data Science, the tool's value to criminals is that it outsources cost and compute to victims. The seller claims 1,072 findings across 199 scanned hosts. Bitsight could not verify those figures and says they should not be read as confirmed incidents or proof the tool works. The report does not show that any particular organisation was compromised.
Where do the keys come from? Help Net Security notes that information-stealing malware harvests credentials, and that a reseller called CloseRouter offered open-weights and commercial models for about $0.10 per million tokens. Its price for the Chinese model GLM was $0.053 per million input tokens, against $1.12 on the official API.
What else did Bitsight find in the underground?
The firm reviewed thousands of posts on 16 underground forums from February to August 2026. Mentions of AI agents, indirect prompt injection and the Model Context Protocol rose 67 percent. Jailbreaking talk grew about 75 percent and vibe coding mentions more than doubled. Overall AI chatter rose 45 percent while ransomware mentions fell 49 percent and phishing 8.5 percent.
Branded criminal chatbots such as WormGPT and FraudGPT fell 8.7 percent, which suggests criminals prefer borrowing capable commercial and open models over building their own. WormGPT itself was breached earlier this year, exposing about 19,000 users' emails, payment details and subscription tiers.
How do you protect your AI keys?
Bitsight's advice, as reported: treat AI provider keys like cloud credentials. Keep them out of source code and logs, rotate them at once if exposure is suspected, limit each key's scope and spending cap, and verify where agent plugins and MCP servers come from. Require human approval for sensitive agent actions. These steps reduce the value of a leaked key but do not end the threat.
The report also flags a malware campaign. Help Net Security attributes about 7,600 fraudulent GitHub repositories spreading SmartLoader malware to an actor it calls Water Kurita, and says more than 800 of them posed as AI skills or MCP servers. Developers who install agent add-ons from unfamiliar repositories are exactly the people such lures target, and they often hold the most valuable keys.
The practical test for any team is easy to run today: look at the provider dashboard for spend you cannot explain.
Published in The Outspoken Digest
Editorial desk
Outspoken Digest Technology DeskSoftware, hardware, artificial intelligence and what they change for everyone else.
Newsletter
The Digest, in your inbox
One edition, sent when it is ready. No noise, and your address is never passed on.
Read Next
More Technology →
Webb Caught a Probable Supernova From the Early Universe Only Days After It Exploded
Oct 18, 2026/2 min read
Webb Maps an Exoplanet's Atmosphere as Egg-Shaped, With a Puffed-Up Evening Side Hotter Than Its Morning Edge
Oct 18, 2026/2 min read
A Hole in a 75,000-Year-Old Shoulder Blade Points to a Wooden Spear, and Perhaps to Neanderthal Care
Oct 18, 2026/2 min read
Anthropic's Own Staff Data: Junior Technical Hires Fell From 27 to 9 Percent as Its AI Agents Outworked Humans
Oct 18, 2026/2 min read