Underground Forums Are Selling AI Attack Panels That Run on Stolen OpenAI and Anthropic API Keys — and the Victims Get the Bill

On a restricted criminal forum, a seller is marketing an autonomous penetration-testing panel with a simple pricing model: bring your own stolen API keys. The tool, branded MONST3R-AI, runs on compromised OpenAI, Anthropic and Google credentials — the buyer pastes in keys lifted from someone else, sets a spending cap, points the agent at a target list, and every scan is billed to the key's rightful owner. The seller hosts no model at all, which both sidesteps the provider's safety training and shifts the metered cost of the attack onto a stranger.

The seller's own dashboard claims 1,072 security findings across 199 scanned hosts. Bitsight, whose threat intelligence team surfaced the tool, says it cannot verify those numbers — but argues that even a small accurate share would make the tool effective, and expects stolen API keys to be sold increasingly as fuel for exactly this kind of autonomous scanner. The pattern has a name, LLMjacking, first documented by Sysdig in 2024; in one previously reported case, attackers used a stolen key to consume roughly $600,000 of inference credits in about three weeks before anyone noticed.

The finding comes from a Bitsight Cyber Threat Intelligence analysis of thousands of posts across 16 underground communities — from stolen-account resale boards to technically advanced Russian-language hacking forums — covering February through August 2026. In a fitting detail, the researchers ran the study using the Bitsight MCP server and its Threat Hunting Intel Items API, querying and refining searches conversationally across ten keyword categories spanning jailbreak vocabulary, stolen keys, AI models, agents and MCP references.

The trend lines are striking because the control group moved the other way. AI-related discussion across the forums grew 45 percent over the window, while ransomware mentions fell 49 percent and phishing fell 8.5 percent; branded criminal chatbots like WormGPT and FraudGPT slipped 8.7 percent. Mentions of AI agents, indirect prompt injection and the Model Context Protocol rose 67 percent, and jailbreaking — still the largest genuine activity tracked — grew about three quarters. Even "vibe coding" more than doubled, though in elite circles the term now functions as an insult for people who lean on AI without understanding the code.

The more telling shift is in tooling. Mentions of open-weights models like GLM, DeepSeek and Kimi climbed sharply, because anyone can download them and run them on rented GPUs with no provider checking requests, logging usage or banning accounts. Posters on Chinese- and Russian-language boards now rank models by how readily they comply without triggering guardrails, and capable operators perform abliteration — stripping safety behavior from the weights — entirely in-house. Access is cheap: a reseller called CloseRouter advertised flat-rate access to open-weights and commercial models at around ten cents per million tokens, with GLM listed at $0.053 per million input tokens against $1.12 from the official API.

The forum chatter also mirrors real campaigns. Members are dissecting FakeGit, attributed to the actor Water Kurita, which seeded roughly 7,600 fraudulent GitHub repositories to spread SmartLoader malware — more than 800 of them posing as AI skills or MCP servers, including a lookalike "Docker MCP Gateway," to get indexed in public AI registries that agent platforms pull from. Bitsight separately notes that WormGPT itself was breached earlier this year, exposing the emails, payment data and subscription tiers of roughly 19,000 users. Two groups face direct exposure: companies that leak an AI provider key, and engineering teams that install agent plugins from public registries without checking where they came from.

The report's practical upshot is unglamorous but concrete: treat AI provider keys as production secrets — rotate immediately on any suspicion of exposure, scope them to the smallest practical budget, and verify the provenance of every agent extension before install. The deeper point is that the underground has stopped treating AI as a curiosity and started treating it as both tool and target, with a division of labor between expert developers and low-skill buyers. The forums are now a product market for agentic attack infrastructure, and the invoice for using it goes to whoever was careless with a key.