MONST3R-AI Uses Compromised AI Keys for Autonomous Scans, Shifting Costs
Criminals sell a scanner that runs on compromised OpenAI, Anthropic and Google keys, forcing victims to pay for the compute costs of attacks on third parties.
Key points
- MONST3R-AI uses stolen API keys to run autonomous penetration tests, charging the key owner for the activity.
- Bitsight tracked a 67 percent rise in mentions of AI agents and indirect prompt injection on underground forums.
- Two groups are at risk: organizations with leaked keys and teams installing unverified agent plugins from public registries.
The MONST3R-AI tool represents a shift in how attackers fund their operations by leveraging stolen credentials from major AI providers. Instead of paying for compute resources, the operator uses compromised API keys from OpenAI, Anthropic, and Google. This approach forces the legitimate key holder to absorb the financial cost of the scanning activity, effectively turning the victim’s infrastructure into an attack platform.
Root cause
The underlying issue is the exposure of high-value API credentials that grant access to powerful language models. When these keys are leaked or stolen, they provide attackers with the computational power needed to run complex, autonomous tasks. The seller of MONST3R-AI does not host any models themselves, relying entirely on the stolen access to bypass provider safety controls and generate findings.
Attack path
An attacker acquires stolen API keys and inputs them into the MONST3R-AI panel. They set a budget cap to limit spending and provide a list of target hosts. The tool then uses the AI provider’s resources to autonomously scan those targets. The charges for these scans appear on the victim’s bill, while the attacker gains intelligence on the third-party systems without incurring direct costs.
Affected versions
- Organizations that have exposed OpenAI API keys
- Organizations that have exposed Anthropic API keys
- Organizations that have exposed Google API keys
- Engineering teams using agent plugins from public registries without verification
Mitigation
- Rotate all AI provider API keys immediately if there is any suspicion of exposure.
- Implement strict budget caps and usage alerts on all AI service accounts.
- Audit and verify the integrity of any agent plugins or tools installed from public registries before deployment.
- Monitor cloud billing dashboards for unusual spikes in AI token consumption that do not align with normal business operations.
Signals worth monitoring
Security teams should watch for anomalous billing patterns on AI service accounts, such as sudden spikes in token usage or requests from unexpected geographic regions. Unusual outbound traffic from systems that should not be scanning external hosts may indicate autonomous tooling is active. Check whether any internal services are making API calls to AI providers without proper authentication or authorization. Look for indicators of compromise in logs that show automated, repetitive scanning behavior originating from your infrastructure.
Background: Indicators of attack
Indicators of attack are behavioral patterns that signal an active adversary. Unlike static indicators of compromise, they focus on actions like lateral movement or data staging. Monitoring these behaviors allows security teams to detect and stop intrusions in progress, rather than reacting after damage is done.
Read the full guide: Indicators of Attack: Definition, Detection, and Practical Usage
What to do and how to stay safe: OpenAI
- Review all API keys associated with AI providers and rotate any that have been shared or stored insecurely.
- Set up immediate alerts for any usage that exceeds normal baseline patterns for your AI services.
- Verify the source and integrity of any third-party plugins or agents before integrating them into your development pipeline.
- Monitor your cloud billing statements daily for unexpected charges that could indicate unauthorized use of your credentials.
Step-by-step guide: Attack Surface Management: 6 Common Misreadings and Correct Views
General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How does MONST3R-AI work?
It uses stolen API keys from providers like OpenAI to run autonomous scans, charging the victim for the compute costs.
Who is at risk from this trend?
Companies that leak AI provider keys and engineering teams that install unverified plugins from public registries.
What did Bitsight find in their research?
They found a 67 percent increase in mentions of AI agents and indirect prompt injection on underground forums between February and August 2026.
