Stolen AI API Keys Now Fund Autonomous Attacks — And You Pay

The interesting part of the autonomous-hacking story is no longer that an AI can find a bug. It is who pays the compute bill. A seller on a restricted criminal forum is marketing an autonomous penetration-testing platform that runs entirely on stolen OpenAI, Anthropic and Google API keys: the buyer pastes in keys lifted from someone else's account, sets a spending cap, points the agent at a target list, and the key's rightful owner is billed for the scan. Bitsight's threat-intelligence team surfaced the tool while tracking thousands of posts across 16 underground forums from February through August 2026, as reported by Help Net Security on October 16, 2026. The economics of offensive AI just inverted, and that is the news.

Developing story — first published 07:13 CEST (05:13 UTC), 16 October 2026. Updated as researchers and the named platforms publish more.

The business model: paste a stolen key, set a budget, pick targets

The advertised tool — the seller calls it MONST3R-AI — is sold as a self-service panel. You supply the stolen credentials, you supply the target list, the agent does recon, vulnerability matching and proof-of-concept drafting on its own, and it stops when the budget you set runs out. The seller claims 1,072 findings across 199 scanned hosts; Bitsight notes it cannot verify that number, and neither can we.

The design choice that matters is this: the seller hosts no model of its own. By routing every inference through a victim's commercial API account, the operation sidesteps the safety training baked into the provider's hosted product — and shifts the metered cost onto a stranger. This is the operational face of what researchers have been calling LLMjacking: the theft and unauthorized use of AI API credentials, first documented by Sysdig in May 2024 and now, per a Cloud Security Alliance research note from June 2026, a foundational attack primitive rather than a cost-shifting nuisance.

Why steal keys instead of buying compute

Agentic offense is token-hungry. An autonomous agent that fingerprints services, reasons about each finding, drafts a PoC, retries, and pivots burns a great deal of inference — and inference has a per-token price. Pay for it honestly at scale and the margin disappears. Steal the capacity and the attack is free to the attacker and invisible on the victim's bill until the invoice lands.

The invoices are not small. The CSA note cites Sysdig's original estimate of over $46,000 per day of exposure for a single hijacked Claude-class account. And in March 2026 the AI-evaluation non-profit METR had an API key stolen and watched attackers consume $600,000 of inference credits over roughly three weeks before anyone noticed — the abuse blended in because METR legitimately runs evaluations that burn large volumes of tokens, as ITPro reported. Three weeks of undetected, attacker-controlled frontier-model compute, paid for by the victim. That is the detection gap this market is built on.

There is a wholesale layer too. Resellers broker the stolen access at a fraction of list price — Bitsight recorded a service advertising the open-weights model GLM at $0.053 per million input tokens against $1.12 from the official API. When the raw material is someone else's credential, the price floor is theft, not cost.

This is not hype — but read the forum data honestly

It would be easy to turn this into another "AI is supercharging hackers" headline. The forum data is more specific than that, and more useful. Across Bitsight's February-to-August window, mentions of AI agents, indirect prompt injection and the Model Context Protocol (MCP) rose 67%; AI-related discussion overall grew 45%; jailbreaking talk grew about three-quarters; and references to vibe coding more than doubled. Over the same window, ransomware mentions fell 49% and references to the old branded criminal chatbots (WormGPT, FraudGPT) fell 8.7% — WormGPT itself was breached in 2026, exposing roughly 19,000 users. The subculture is migrating from "buy a jailbroken chatbot" to "wire an agent into stolen infrastructure."

The honest caveat belongs here. Sophos's Counter Threat Unit, surveying the same underground, found that only a limited number of actors have actually operationalized generative AI, that personas routinely ask each other for basic setup help, and — in their words — that "many claims have not been validated." Marketing a tool on a forum is not the same as the tool working.

What is validated is the plumbing, not the bravado:

• VAPT (documented by Sysdig, June 2026): an automated exploitation framework using a hijacked, internet-exposed Ollama server as its reasoning engine — service fingerprinting through privilege escalation, running without an operator between stages.
• Operation Bizarre Bazaar (Pillar Security, Dec 2025–Jan 2026): ~35,000 attack sessions against LLM-endpoint honeypots and a resale marketplace selling access to 30-plus providers.
• A Sysdig-documented May 2026 intrusion where an LLM agent chained four pivots to a PostgreSQL dump in under two minutes — 12 API calls across 11 points of presence in a 22-second burst.

The capability is real and cheap; the swagger is often inflated. Treat both facts as true at once.

What to do now

There is no patch for an economic shift, but there is hygiene. Treat an AI provider API key exactly as you treat an exposed cloud root credential — Bitsight's own advice is to "treat a leak as seriously as an exposed AWS credential."

• Find your exposed keys. Scan source repos, CI logs, .env files, notebooks, and any "vibe-coded" internal app for provider keys. The METR key leaked through a fail-open auth bug on a quickly-built app; that is the modal path, not a sophisticated breach.
• Cap and alarm every key. Set hard per-key spend limits and alert on unusual spend, new source regions, or a spike in token volume. METR had no way to cap a key at the time; most teams still don't.
• Rotate on any doubt, and scope keys narrowly — separate production inference from experimentation so one leaked credential is not a blank cheque.
• Watch the wire, not just the invoice. Both halves of this attack — the exfiltration of the key and the autonomous scan it funds — generate network behavior: anomalous egress to never-seen AI endpoints, sustained outbound inference traffic from a host that has no business calling a model API, scan bursts against your own perimeter. The invoice is a lagging indicator; the traffic is not.
• Assume the agent is impatient. Budget-capped agents scan fast and broadly. Rate-limit and monitor your externally reachable services for the fingerprint-everything pattern these tools produce.

What is not known yet

Bitsight cannot verify MONST3R-AI's claimed findings, and we have not tested the tool. The true size of this market, how many of the advertised platforms actually function versus how many are forum vaporware, and whether the major providers' abuse-detection closes the stolen-key window faster than sellers can refill it — all open. The one thing the data settles is direction: the demand signal has moved decisively toward agentic offense running on borrowed compute.

Running the attacker's economics in reverse

Strip the crime away and the attacker's playbook is a checklist defenders should already own: point an autonomous agent at your own attack surface and let it find what a human quarterly test misses. Zero Hunt is that capability built the legitimate way — an autonomous AI red team whose 10-agent swarm fingerprints each target, writes a per-environment proof-of-concept with a sealed coding agent, and files every finding signed at write time. The difference is the one this whole story turns on: it runs on-premise on private models we own (ZeroHunt Apex and Apex Pro), so there is no provider account to drain, no per-token bill that makes continuous testing uneconomical, and no third-party model that can refuse, throttle or be switched off mid-campaign. The attackers steal keys because token-metered autonomy is expensive; we removed the meter. See how continuous automated penetration testing replaces the annual engagement the XBOW full-chain exploit result already made look slow.

And because the key theft and the autonomous scan both live on the network before they ever reach a bill, Zero Hunt's traffic-analysis model — four inference heads on the appliance GPU, trained on billions of PCAP sequences — is watching for exactly the egress and scan signatures this market produces, while it is happening rather than in next month's cloud invoice.