Autonomous Hacking Tool MONST3R-AI Exploits Stolen AI API Keys to Fund Attacks

Criminal operators are marketing an autonomous hacking agent called MONST3R-AI on restricted cybercrime forums, leveraging a novel financial model: buyers supply stolen API keys from OpenAI, Anthropic, or Google, and the tool bills legitimate key holders for the computational cost of scanning their own systems. According to threat intelligence from Bitsight, the agent operates through a web panel interface where attackers paste compromised credentials, set a budget cap, and supply target lists. The system then autonomously scans systems for security weaknesses without direct human steering, representing a shift toward fully autonomous attack infrastructure that industry researchers describe as a watershed moment for cybersecurity.