A new attack tool uses stolen AI keys, and the owner pays

A seller on a criminal forum sells MONST3R-AI, an attack tool that does scans without a person. It uses stolen OpenAI, Anthropic and Google API keys, and the owner of each key pays for the scans. Bitsight, a threat intelligence team, tracked 16 underground forums from February to August 2026. Bitsight says that posts about AI agents, indirect prompt injection and the Model Context Protocol increased by 67 percent.

How the tool works

The buyer puts stolen keys into a panel and sets a budget limit. Then the buyer gives the agent the targets. The seller has no model, and the victim gets the charges.

The seller says the tool found 1,072 issues on 199 hosts. That number comes from the dashboard of the seller. Bitsight cannot check it.

Forum trends

Between February and August 2026, posts on the forums changed as follows:

• Posts about AI increased by 45 percent.
• Posts about ransomware decreased by 49 percent.
• Posts about open-weights models, such as GLM and DeepSeek, increased.

Bitsight says that takedowns and moves to closed channels can cause part of the ransomware drop.

Plugin risk

Persons link FakeGit, an attack campaign, to the actor Water Kurita. About 7,600 fake GitHub repositories spread SmartLoader malware. More than 800 of them had the names of AI skills or MCP servers.

What to check

• Look for AI provider keys that are not in a safe place.
• Check the source of each MCP server and agent plugin.
• Do not let code agents use sensitive folders or shell commands without approval from a person.