Bitsight Exposes MONST3R-AI: Cybercriminals Selling Autonomous Hacking Tool That Bills Victims Via Stolen AI Keys

A cybercrime marketplace is selling MONST3R-AI, an autonomous penetration testing platform that exploits stolen API credentials to fund automated attacks against third-party targets. According to Bitsight's threat intelligence research, the tool operates by allowing buyers to paste stolen OpenAI, Anthropic, and Google API keys into a dashboard, set a spending cap, and direct the agent at a target list—with legitimate API account holders footing the bill for the reconnaissance and exploitation activities.