Bitsight: a criminal "AI pentest" tool runs on stolen OpenAI, Anthropic and Google API keys

Threat-intelligence firm Bitsight reported on October 15, 2026 that a seller on a restricted criminal forum is marketing MONST3R-AI, an autonomous "penetration testing" tool that hosts no AI model of its own and runs on stolen OpenAI, Anthropic and Google API keys, so the victim whose key was stolen pays for the attacks. Any organization or developer that uses commercial AI APIs should check for leaked keys, set spending caps and alerts, and treat an exposed AI key with the same urgency as an exposed cloud credential.

What happened, in plain English

When a company builds something on top of ChatGPT, Claude or Gemini, it usually gets an API key (API means application programming interface: the way one program talks to another). The key is a long secret string. Whoever holds it can use the AI service, and the bill goes to the account that owns it.

Bitsight analysed thousands of posts on 16 underground forums between February and August 2026. One finding stands out: a tool called MONST3R-AI, sold on a highly restricted forum. According to Bitsight, the buyer pastes stolen API keys into a control panel, sets a budget cap, and gives the tool a list of targets. An AI agent (an AI that takes actions on its own, not just answers questions) then scans those targets for weaknesses.

The criminal running the tool pays nothing for the AI. The company whose key was stolen does.

Think of it like a stolen company fuel card: the thief does not just get free fuel, they use it to drive a getaway car, and your company gets the invoice.

The seller claims the tool produced 1,072 findings across 199 scanned hosts. Bitsight stresses this is a "self-reported dashboard figure we cannot independently verify." Its point is that even a modest hit rate would make such a tool useful to criminals, and that stolen AI keys will increasingly be sold to feed scanners like this one.

Are you affected? What to do now

You should care if your organization, a team, or an individual developer holds API keys for OpenAI, Anthropic, Google or other AI providers, including keys pasted into third-party tools, scripts, notebooks or CI/CD pipelines (the automated build-and-deploy systems). If nobody in your organization uses AI provider APIs directly, this item is mainly awareness.

Check exposure

• Inventory your AI keys. Which teams have them, where are they stored, and which third-party tools have been given one?
• Scan code for secrets. Turn on secret scanning in your source-control platform and add a scanner such as Gitleaks to your CI/CD pipeline, as Anthropic recommends. On October 13, 2026, GitHub announced that push protection now blocks commits containing two Anthropic key types by default in repositories with secret scanning enabled.
• Review usage dashboards for spend or traffic you cannot explain, especially at odd hours or from unfamiliar projects.

Reduce the damage a stolen key can do

• Set spend thresholds and alerts. OpenAI advises multiple alert thresholds (for example at 90% and 95% of a monthly budget) at organization or project level, sent to a mailing list or incident tool. Anthropic notes that usage and spend limits, and careful auto-reload settings, guard against leaked keys.
• One key per project, team and environment (development, test, production), so you can revoke one without breaking everything.
• Rotate keys on a schedule. Anthropic suggests every 90 days.
• Store keys in a secret manager, never in code, config files or tickets. Keep .env files out of source control.

If a key leaks

• Delete or deactivate the key immediately, review recent usage, and contact the provider. Anthropic says keys found in public GitHub repositories are deactivated automatically and the owner is emailed; that does not cover leaks elsewhere (chat logs, paste sites, laptops).

Also from the same report

• Vet MCP servers and agent plugins before installing. MCP (Model Context Protocol) is a standard way to plug tools into AI assistants. Bitsight describes a campaign it attributes to an actor called "Water Kurita," with about 7,600 fake GitHub repositories spreading SmartLoader malware, more than 800 of them posing as AI "skills" or MCP servers, including a lookalike "Docker MCP Gateway."
• Limit local coding agents. Keep them away from sensitive folders and require human approval for shell commands.
• Watch for bot-like logins to platforms such as Notion, Slack and GitHub; Bitsight notes that agents driving browsers tend to work at a distinct cadence.

The expert view

The interesting part of MONST3R-AI is not the AI; it is the business model. Earlier criminal AI products such as WormGPT and FraudGPT were branded chatbots sold as subscriptions, which meant someone had to run, pay for and hide a model. MONST3R-AI is "bring your own key" (BYOK): a thin orchestration layer, a panel, and an agent harness that borrows a frontier model through a stolen credential. Compute costs land on the victim, and the attacker gets a more capable model than most self-hosted options.

That shifts how defenders should classify these secrets. An AI API key used to look like a billing risk. In this model it is an attack-capability credential: it buys reconnaissance against third parties, and the provider's abuse logs will show your organization's account as the source. Bitsight's own wording, "Treat an exposed AI provider key with the same severity as an exposed AWS credential," is the right baseline.

There is also a quiet tension here. Using a commercial key means traffic passes through the provider's safety systems and logging, which can flag and ban abusive use. Bitsight separately reports that more capable actors are moving the other way, running open-weights models such as GLM and DeepSeek on rented servers where provider controls do not apply, and that resellers advertise access at around ten cents per million tokens. The likely split: lower-skill actors borrow commercial models via stolen keys; higher-tier actors self-host. Both trends point to the same conclusion Bitsight draws, that the agent harness and orchestration matter more than the underlying model.

The wider numbers are worth reading carefully. Over the period studied, Bitsight counted a 45% rise in AI-related discussion and a 67% rise in mentions of MCP, AI agents and indirect prompt injection, against a 49% fall in ransomware mentions and an 8% fall in phishing. Bitsight itself warns that keyword counts are an imperfect measure and that the ransomware drop may reflect takedowns and migration to closed channels. Read this as a shift in attention, not proof that AI attacks now outnumber ransomware.

What is still unknown: whether MONST3R-AI works as advertised; how many buyers it has; where the stolen keys come from (Bitsight does not say); and whether the providers have already detected and blocked this traffic. None of the three providers has commented publicly on the tool, as far as we could find. The forum demonstrations Bitsight describes, including an agent breaching an enterprise Notion account, are reported claims, not independently verified incidents.

Official sources

• Bitsight — The New Frontier of Malicious AI: What Underground Forums Tell Us About the Evolution of Cybercrime Tradecraft (October 15, 2026)
• GitHub Changelog — Secret scanning blocks Anthropic keys by default, adds Salesforce (October 13, 2026)
• Anthropic — API key best practices: keeping your keys safe and secure
• OpenAI — Preventing unauthorized usage
• Coverage: Help Net Security — Stolen AI API keys are paying for hackers' autonomous scans