Stolen AI API Keys Are Paying for Hackers' Autonomous Scans
Help Net Security, Friday, October 16th, 2026
Bitsight found a criminal tool that runs autonomous hacking on stolen OpenAI, Anthropic and Google API keys.
Bitsight tracked thousands of posts on 16 underground forums from February to August 2026 and found mentions of AI agents, indirect prompt injection and MCP up 67%.
One seller is marketing MONST3R-AI, an autonomous penetration testing platform where buyers paste stolen AI provider keys, set a budget and point it at targets, so the key owner pays and provider safeguards are sidestepped.
The seller claims 1,072 findings across 199 hosts, which Bitsight could not verify.
Companies that leak AI keys and teams that install agent plugins from public registries are both exposed.