As cited
Copy frozen at (site build).
ai security
Stolen AI API keys are paying for hackers’ autonomous scans
A criminal seller is marketing an autonomous hacking tool that exploits stolen application programming interfaces (APIs) from OpenAI, Anthropic, and Google, allowing attackers to run reconnaissance scans while the victims pay for the compute costs. Bitsight's threat intelligence team identified this shift across 16 underground forums between February and August 2026, noting a 67 percent rise in mentions of artificial intelligence (AI) agents, indirect prompt injection, and the Model Context Protocol (MCP). Two victim groups are exposed by this technique.
Why it matters: Organizations using OpenAI, Anthropic, and Google APIs face financial and operational risk if credentials are compromised; practitioners should audit API key access logs and rotation policies immediately.
- Source published
- First seen by Cybersecurity Tracker