Helpnetsecurity Autonomous AI Attacks Using Stolen API Keys on the Rise
Article Content
- •The MONST3R-AI tool uses stolen API keys for autonomous hacking.
- •AI-related discussions on criminal forums increased by 45% while ransomware discussions fell by 49%.
- •Real-world AI attacks have been documented, including command execution and data theft.
A criminal forum is promoting an autonomous hacking tool named MONST3R-AI that utilizes stolen OpenAI, Anthropic, and Google API keys, allowing attackers to conduct scans at the expense of the key owners. The tool reportedly has scanned 199 hosts, yielding 1,072 findings, although these numbers are unverified. The increase in discussions about AI agents and jailbreak techniques has surged, with mentions of open-weight models rising sharply. Meanwhile, ransomware discussions have dropped significantly, indicating a shift in focus among cybercriminals. Notably, the tool bypasses safety protocols by leveraging the API keys of unsuspecting victims. Additionally, a blog post detailed real-world AI-driven intrusions, including command executions and data theft. The CVE-2026-0766 vulnerability was exploited in some of these attacks, showcasing the evolving landscape of AI in cybersecurity threats.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Following this threat?
Track CVE-2026-0766 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
What is MONST3R-AI?
How are API keys being exploited?
What vulnerabilities are involved?
Continue Reading
FakeGit Malware Campaign Resurfaces with 17,610 Malicious Repositories The FakeGit malware campaign has reactivated, distributing SmartLoader malware via over 17,610 fake repositories on GitHub. This resurgence, noted by researchers from Apiiro, began on October 4, 2026, and has already seen the creation of more than 13,000 repositories in just 34 hours. The malicious repositories employ… 
CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…