Stolen AI-provider keys are being used to pay for autonomous scans, while discussion of AI agents and related tools is growing in underground forums, according to a report published by Help Net Security. The useful distinction: the forum chatter is a measure of attention, not proof that attacks themselves rose by the same amount.
Watch Desk analysis
What happened
Bitsight’s threat intelligence team tracked posts across 16 underground forums from February to August 2026. Help Net Security reports that mentions of AI agents, indirect prompt injection and the Model Context Protocol rose 67 per cent over that period. The report also describes a tool called MONST3R-AI, whose seller allegedly lets buyers use stolen OpenAI, Anthropic and Google API keys to fund scans. In that arrangement, the account holder gets the bill, while the seller does not host a model.
The seller claimed the tool found 1,072 issues across 199 scanned hosts. Bitsight could not verify that dashboard figure, the report says. Treat it as a seller’s claim, not a confirmed tally. The article also describes growth in discussion of open-weight models and fraudulent repositories masquerading as AI skills or MCP servers.
Why it matters
A leaked key can turn a company’s account into someone else’s computing budget, and an imitation plugin can put malicious code in front of an engineering team looking for a useful tool. Those are concrete security problems, even if the report’s forum counts do not tell us how often they result in successful attacks.
The report’s practical advice is straightforward: check for exposed AI-provider keys, verify the source of agent plugins and MCP servers, and restrict what coding agents can access or run without human approval. These are sensible precautions, not proof that every organisation faces the same level of risk.
Our read
The headline statistic needs its seatbelt on: a 67 per cent rise in mentions is not a 67 per cent rise in incidents. But the reported use of stolen keys points to a less abstract issue than another round of criminals discussing AI. Organisations should treat provider credentials like other sensitive cloud keys and give agent add-ons the same scrutiny as software dependencies. “It was in the registry” is not a security review, however tidy the listing looks.
What to watch
- Whether Bitsight or other researchers publish further detail on how they identify and classify these forum posts.
- Whether providers report or introduce controls addressing use of stolen credentials for automated scans.
- Whether organisations begin checking agent plugins and permissions as carefully as conventional software dependencies.
Discussion spark: Should organisations treat AI-agent plugins as software dependencies requiring formal review, or is that too much process for tools that teams need to experiment with?
Sources and evidence
- Source update (16 October 2026, 05:00 UTC)
Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.