Threat
Stolen AI API keys are paying for hackers' autonomous scans
First reported · Discovered helpnetsecurity.com
Page published
Earliest dated coverage: 16 Oct 2026 · First observed: 2 Nov 2026 · Latest dated coverage: 16 Oct 2026
Coverage timeline
Single-source incident — one report is available.
Why it matters
Abuse of stolen AI API keys can make organizations fund autonomous attacks against third parties, highlighting the need for tightly scoped credentials, spending controls and usage-anomaly monitoring.
MONST3R-AI is advertised on a restricted criminal forum as an autonomous hacking platform that accepts stolen OpenAI, Anthropic and Google API keys, charging scans to the key owners. Bitsight identified the offering during underground-forum monitoring but could not verify the seller’s claimed findings across 199 scanned hosts.