Bitsight tracked a fake ‘penetration testing tool’ across 16 forums, where buyers paste in stolen OpenAI, Anthropic or Google keys: it is the account holders who end up paying for the scans.
Bitsight's threat intelligence team observed the promotion of MONST3R-AI on 16 underground forums between February and August 2026. Presented as a standalone penetration testing platform, the tool works in a simple way: the user sticks stolen API keys from OpenAI, Anthropic or Google into a control panel, sets a spending limit and provides a list of targets. The computation costs fall on the victim whose key has been leaked, and the device bypasses the guardrails of the providers. The seller claims 1,072 flaws found on 199 hosts, a figure that Bitsight has not been able to verify.
A parallel economy of models
The report also notes that criminals are increasingly turning to open-weight models (GLM, DeepSeek) hosted on rented, unmonitored servers. One reseller, CloseRouter, offers access at about $0.053 per million entry tokens, compared to $1.12 at the official price.
Bitsight recommends tracking exposed AI keys with the same seriousness as AWS credentials, verifying the origin of MCP servers and agent extensions, prohibiting code agents from accessing sensitive directories and the shell without human validation, and monitoring for anomalous connections on Notion, Slack, or GitHub that would betray an automated browser.
Read the full article on the original source
Go to the source →