Stolen AI API Keys Used to Fund Hackers’ Automated Scans, Report Finds

Stolen AI Keys Fuel Hacking Tools

A new report from Bitsight, covered by Help Net Security↗ (opens in a new tab), says cybercriminals are using stolen API keys from major AI providers, including OpenAI, Anthropic and Google, to run automated hacking tools. The keys, which are meant to let developers access AI models, are being misused so that the legitimate account holder ends up paying for the attackers’ activity.

The tool in question, called MONST3R-AI, is sold on restricted criminal forums. Buyers can paste stolen keys into a dashboard, set a spending limit, and point the tool at a list of targets. The seller does not host any AI models themselves. Instead, the tool uses the stolen keys to access commercial AI services, sidestepping the providers’ safety checks. The costs for running these scans are charged to the owner of the stolen key.

Who Is at Risk?

Two main groups are exposed. First, companies or individuals who accidentally leak their AI provider keys may unknowingly pay for attacks on other people’s systems. Second, engineering teams that install agent plugins from public registries could end up with malware disguised as helpful tools. The report highlights that even a small number of successful scans can make these tools worthwhile for attackers.

The Changing Criminal Marketplace

Bitsight tracked thousands of posts on 16 underground forums from February to August 2026. Mentions of AI agents, prompt injection attacks, and the Model Context Protocol (MCP) rose by 67 percent in that period. Jailbreaking, tricking AI models into ignoring safety rules, remains a hot topic, with discussion up by about three quarters. There is also a shift toward open-weights models, which can be downloaded and run on rented servers without oversight from the original provider. Some forum members even remove built-in safety features from these models, a process called "abliteration."

Prices for access to these models are low. One reseller offered open-weights and commercial models for about ten cents per million tokens, much cheaper than official rates. Meanwhile, talk about ransomware and phishing on these forums has dropped, while AI-related chatter has grown.

Real-World Attacks and Malware Campaigns

The forums also discuss campaigns like FakeGit, where over 7,600 fake GitHub repositories spread malware called SmartLoader. More than 800 of these posed as AI skills or MCP servers to get listed in public AI registries. Attackers have shown off agents that use tools like IDA Pro to find vulnerabilities and even automate breaches of enterprise accounts.

What Should Organisations Do?

Bitsight recommends scanning for exposed AI provider keys and treating a leak as seriously as an exposed cloud credential. Teams should verify the source of every MCP server and agent plugin before use. Local coding agents should be blocked from accessing sensitive directories or running shell commands without human approval. Monitoring login patterns on platforms like Notion, Slack, and GitHub can also help spot suspicious automated activity.

What Is Not Yet Clear

This story is based on a single report from Help Net Security, citing Bitsight’s research. The claims have not yet been confirmed by the affected AI providers or independent sources. The reported number of successful scans (1,072 findings across 199 hosts) comes from the seller’s dashboard and has not been independently verified.