Bitsight identifies a hacking tool marketed to run on stolen AI keys

A stolen AI key can become someone else’s scanning budget. In research published October 15, Bitsight identified a forum seller marketing an autonomous hacking tool that accepts stolen provider credentials and charges their owners. The finding comes from thousands of posts across 16 underground communities, where researchers tracked growing interest in AI-enabled cybercrime.

An attack budget on somebody else’s account

The tool, MONST3R-AI, is advertised on a highly restricted forum as an autonomous penetration-testing platform—software intended to search systems for security weaknesses. Bitsight describes a bring-your-own-key setup: the buyer supplies stolen OpenAI, Anthropic or Google API keys, sets a spending cap and gives the agent a list of targets. Those keys provide access to the providers’ models.

The seller does not have to host a model. Instead, the panel connects the buyer’s scanning workflow to commercial AI services through stolen credentials. According to Bitsight, the resulting API bill lands on the owner of the stolen key. The exposed account therefore supplies both model access and the money to use it.

That describes the advertised mechanism, not a verified success rate. The seller’s dashboard claimed 1,072 findings across 199 scanned hosts. Bitsight explicitly says it could not independently verify those figures. They should not be read as a confirmed count of vulnerabilities or evidence that the tool successfully compromised those systems.

+45%AI-related discussion

Bitsight measured 45% growth in AI-related discussion across the surveyed forums during February–August 2026.

−49%Ransomware mentions

Mentions of ransomware fell 49% in the same forum sample and study period.

−8%Phishing mentions

Mentions of phishing fell 8%, providing another comparison with conventional cybercrime discussion.

Interest is measurable; attack volume is not

The study covers February through August 2026. Researchers tracked ten keyword categories, checked searches for false positives and compared AI discussion with traditional cybercrime terms. Bitsight acknowledges that keyword counts are an imperfect measure. They show attention, not a census of attacks; takedowns or migration to closed channels could also help explain declining ransomware mentions.

There were structural signs of demand, too. At least one-third of the platforms studied had created dedicated AI discussion areas. Mentions of AI agents, Model Context Protocol—the connections between AI tools and outside systems—and indirect prompt injection rose 67%.

Jailbreaking remained the largest category Bitsight tracked, but researchers also observed skilled actors renting GPU servers to run modified open-weight models. These models make their underlying weights available for local use. Forum participants ranked models partly by their willingness to fulfill requests without safety restrictions, while a reseller called CloseRouter advertised model access at around ten cents per million tokens.

The tools themselves become targets

The research also documents forum interest in compromising AI’s surrounding software. Members were dissecting the FakeGit campaign, which Bitsight attributes to Water Kurita. Roughly 7,600 fraudulent GitHub repositories distributed SmartLoader malware; more than 800 posed as AI skills or MCP servers to get indexed in public AI registries. A seemingly useful agent add-on could therefore be the delivery vehicle for malware.

Another forum demonstration linked an AI agent to IDA Pro, a tool for examining software code. Bitsight says the agent identified a buffer-overflow vulnerability and produced an exploit plan. Alongside the stolen-key panel, this illustrates the study’s central distinction: actors are assembling systems that perform security tasks, rather than only buying access to chatbots marketed as unrestricted.

The defensive response spans both credentials and software sourcing. Help Net Security recommends scanning for exposed AI provider keys, verifying the origin of MCP servers and agent plugins, and requiring human approval before local coding agents access sensitive directories or shell commands. Those checks address two different entry points described in the study: stolen access and malicious tools.