Help Net Security2026-10-16 05:00:24

Stolen AI API keys are paying for hackers’ autonomous scans

A seller on a restricted criminal forum is marketing an autonomous hacking tool that runs on stolen OpenAI, Anthropic and Google API keys, so the key’s owner pays for the scans.

Summary

Bitsight’s threat intelligence team tracked the shift across thousands of posts on 16 underground forums from February through August 2026. Over that window, mentions of AI agents, indirect prompt injection and the Model Context Protocol (MCP) rose 67 percent. Two groups are exposed.

newsreportcybercrimethreat intelligenceapi securitybitsight

This is a brief wire summary, the full story (linked below) has the complete details.

KazaSec's take

Web and API vulnerabilities like this are exactly what manual penetration testing is designed to catch, automated scanners routinely miss the logic flaws and chained issues that cause the most damage in practice.

Coverage details

Source: Help Net Security
Published: 2026-10-16 05:00:24
Author: anamarija pogorelec
Category: technology

We've archived 707 other articles touching the same topic (news, report, cybercrime) , see the full security news archive.

Worried this kind of story could be about you next?

We help organizations find and fix the gaps before they make headlines.

Request a Security Assessment Browse Services