The Pulse
Bitsight Finds MONST3R-AI Tool Uses Stolen Keys for Scans
Bitsight says a seller is marketing MONST3R-AI, an autonomous scanning tool that uses stolen OpenAI, Anthropic and Google API keys. The seller claimed 1,072 findings across 199 hosts, but Bitsight could not verify those results.
AI.info Team · Written with AI ·
MONST3R-AI is marketed as an autonomous penetration-testing platform, but its buyers can run it using stolen API keys from OpenAI, Anthropic or Google—and leave the service bill with the key’s owner. Bitsight described the tool in research published October 15, 2026, after tracking thousands of posts across 16 underground communities. The seller says the platform found 1,072 issues across 199 hosts; Bitsight says it cannot verify those results.
MONST3R-AI shifts the bill to key owners
Buyers paste stolen credentials into the tool’s interface, set a spending cap and provide a target list. The seller does not host its own model, according to Bitsight. Instead, the platform sends requests through the compromised provider accounts, so the organizations that own the keys pay for the AI usage.
That arrangement also changes where provider safeguards apply. Bitsight says the tool’s design bypasses providers’ safety training, while the stolen credentials authorize the activity as account usage. The resulting scans target other systems, but the usage charges land on the breached account holder.
“Its seller claimed 1,072 findings across 199 scanned hosts; that is a self-reported dashboard figure we cannot independently verify, but even if a small percentage of it is accurate, it represents an effective tool that will only become more potent over time.”
Nethaniel Ribco, staff cyber threat intelligence researcher, Bitsight
Forum posts point to changing criminal interests
Bitsight reviewed activity from February through August 2026. Across the forums it selected, AI-related discussion increased 45%, while mentions of ransomware fell 49% and phishing fell 8%. Mentions of AI agents, indirect prompt injection and the Model Context Protocol rose 67%.
Those figures track forum discussion, not confirmed attacks or the number of criminals using AI. Bitsight cautions that some of the decline in ransomware references may reflect law-enforcement takedowns or actors moving to closed channels. The researchers say the comparison suggests a shift in attention, but it does not measure the volume of real-world activity.
Open models and agent tools attract attention
The research also describes increased discussion of open-weights models, including GLM and DeepSeek. Such models can be run on rented servers without a provider reviewing requests, retaining service logs or disabling an account, Bitsight says. Some forum members rank models by how readily they comply with requests, while others discuss removing safety behavior themselves.
Bitsight also cites examples that go beyond model selection. One forum participant demonstrated an agent connected to the IDA Pro disassembler to identify a buffer overflow and draft an exploit plan. Another used a browser-automation agent in a demonstration of breaching an enterprise Notion account.
Bitsight urges teams to treat AI keys as credentials
Bitsight recommends scanning for exposed keys from AI providers and responding to a leak with the same seriousness as an exposed AWS credential. The company also advises teams to check the origin of MCP servers and agent plugins, since malicious software can pose as useful developer tooling.
For local coding agents, Bitsight recommends limiting access to sensitive directories and shell commands unless a person approves the action. It also advises security teams to establish normal login patterns for services such as Notion, Slack and GitHub, then watch for unusual automated activity. The clearest immediate exposure in the MONST3R-AI case is concrete: a stolen key can authorize scans on someone else’s targets while charging the key’s owner.