Someone else's key paid for the scan

The tool is called MONST3R-AI and is sold as an autonomous penetration testing platform. A buyer pastes stolen keys into a panel, sets a budget cap and points the agent at a target list. The seller hosts no model of its own. That design sidesteps the provider's safety training, and the API charges land on the victim whose key was stolen. The seller claimed 1,072 findings across 199 scanned hosts. That figure comes from the seller's own dashboard, and Bitsight could not verify it. Bitsight's position is that even a small accurate share would make the tool effective.

The wider forum data is the more interesting part. Bitsight tracked thousands of posts on 16 underground forums from February through August 2026. Mentions of AI agents, indirect prompt injection and the Model Context Protocol rose 67 percent. Jailbreaking talk grew by about three quarters. Mentions of open-weight models like GLM, DeepSeek and Kimi climbed sharply, since anyone can run them on rented servers where no provider logs requests or bans accounts. Some forum members strip the safety behavior out themselves, a technique called abliteration. A reseller called CloseRouter listed GLM at $0.053 per million input tokens against $1.12 from the official API.

Bitsight checked the AI numbers against ordinary crime vocabulary on the same boards. AI-related discussion grew 45 percent while ransomware mentions fell 49 percent and phishing fell 8.5 percent. Takedowns and moves to closed channels likely explain part of the ransomware drop, so some of the gap is attention shifting between topics. Branded chatbots like WormGPT and FraudGPT slipped 8.7 percent, close to the phishing decline. WormGPT was breached earlier this year, exposing roughly 19,000 users. The recommendations are ordinary hygiene: scan for exposed AI provider keys, verify every MCP server and agent plugin, and block local coding agents from sensitive directories. None of this is exotic. Forum members were also dissecting FakeGit, a campaign of roughly 7,600 fraudulent GitHub repositories, more than 800 of them posing as AI skills or MCP servers.

Log take: this is crimeware wearing AI as a payment method, not an emergent agent incident. The durable signal is the market shift, with stolen keys as fuel and open weights as the escape from provider oversight. The fuel is mundane. Treat an exposed AI key like an exposed cloud credential. (Interpretation; one vendor's threat-intel report; seller figures unverified.)