{"slug": "ai-agents-in-the-underground", "title": "AI Agents in the Underground", "summary": "An operator reportedly used a self-built AI-powered penetration-testing agent to find a hardcoded admin token for Earnipay's wallet and pull the company's entire ledger, exposing approximately 10,260 customer records, a ledger of 12,305 wallets worth about ₦319,000,000, and a few BVNs, with the dump allegedly being sold for approximately $10,000. The case study, drawn from underground forum posts rather than vendor reporting, found no CVE or media coverage for the incident and notes that about a third of all forum posts mentioning \"AI agent\" describe human-assisted activity at every step rather than autonomous agent attacks. The findings place completed agent-driven crimes at the top of a maturity ladder whose lower rungs hold tools being sold and pitches seeking funding, including a contest entry pairing an agent harness with OpenCode and a jailbreak prompt to generate credential-stuffing tools targeting SendGrid, Stripe and Twilio.", "body_md": "How far have AI agents really moved into cybercrime? Outside a few headlines it is hard to separate genuine capability from hype — and the most honest view is not in vendor blogs but on the underground forums and markets, where the tool, the method and the sale often sit in one place. We went there to answer three questions:\n\n- \nAre there known cases of people using autonomous AI to carry out attacks? Or is it purely speculative?\n- What defines an ‘agent attack’ from other, more mundane, forms of AI-enabled crime? AI-powered phishing, chatbots and jailbreaks are growing. They are inevitably going to be incorporated into discussions around agent attacks.\n- How developed is the ecosystem consisting of the tools, services and infrastructure used by criminals to facilitate their activities with the aid of agents?\n\n## What counts as an agent attack\n\nAn AI agent is software that can be instructed to accomplish a goal by utilizing its planning capabilities and other assets at its disposal to take action and make progress towards accomplishing the task at hand. The article highlights how threat actors have already started utilizing these capabilities to develop weapons. We will address attacks where the agents themselves are the target of the attacks (such as compromising the agents, stealing their keys, breaking out of their sandboxes, etc.) in an article we will publish later.\n\nWhen an agent takes actions like reconnaissance or exploitation and finally orchestrates a Malware-as-a-Service attack (including recruiting victims) then the agent is the weapon. We classified such agents in this case study.\n\nWhat distinguishes a true agent case from the exaggerated claims? Is the system acting independently across multiple steps and tools? In that case, a human is prompt-engineering the system. True agent cases are rare. The chatbot that constructs phishing links and the model that writes phishing emails, or the instance where an AI generates malware, are all assisted by a human at every step, and are not acting independently. A large portion of the AI agent mentions in the underground forums falls into this category. In fact, about a third of all posts in the forums that mention “AI agent” are assisted by a human at every step.\n\n## Attacks using AI agents: a maturity ladder\n\nYou can find the same general idea across multiple posts, at different stages of completion. The posts are generally arranged in increasing order of completion and can be considered as steps on a ladder. The last step, which is real damage already done, shows completed crimes. Prior steps, in order of increasing completion, are tools being sold, and pitches looking for funding.\n\n### Stage 1: already doing damage\n\nThe clearest example is one you’ll never find in a vendor blog because it lives on the forum. An operator was reportedly running their own AI-powered penetration testing agent, and in the process, was reportedly hitting a whole lot of services. Their agent was reportedly successful in locating a hardcoded admin token for Earnipay’s wallet, and in pulling the entire Earnipay ledger. There is neither a CVE nor media coverage for this. The operator posted evidence and the dump is allegedly being sold.\n\nWhat was lost: Approximately 10,260 customer records (name, email, phone, bank, account number, account balance), a ledger of 12,305 wallets worth about ₦319,000,000, and a few BVNs. The seller notes that a collection like this could be identity matched, and sell for approximately $10,000. This is what “an agent already doing damage” looks like. This is only visible because we are looking through the underworld.\n\n### Stage 2: built, sold and taught\n\nThe largest category of posts shows people creating products from the prompts. Skill is not required. You purchase the tools.\n\nOne contest entry includes a ready-to-go agent harness along with OpenCode and a jailbreak prompt to automatically produce and run credential stuffing tools to target SendGrid, Stripe, Twilio, Binance, AWS, and other products and crypto wallets. The entry also shows how to automate phone calls. One of the agents can make 50 calls, navigate phone menus, and fetch a human to complete the call if needed. The technology is already being employed. One item in the job postings category offered a position to learn how to break into systems, and keep 50% of the profits.\n\nThe owner of the job post claims the profits are generated through an AI agent, and the owner does not have to do anything but collect.\n\n### Stage 3: still just ideas\n\nThere are gaps in Fundraising and Pitching skills.\n\nAn example is an individual’s ability to raise $10k to produce an AI tool that automates the process of exploiting smart contracts. The tool, in this case, would involve building a model to scan smart contracts and other resources, and in turn, generate code to exploit smart contracts. These resources would include Slither, Foundry and Mythril. It’s worth noting that no product exists. This is purely a venture capital funded project.\n\n### A reality check\n\nThe operators of these systems set the same expectations for defenders. One of the upper tier threat actors, currently reviewing several “AI hacking” frameworks, noted that most of them are “basic conversational prompt wrappers” and that it would be “great to see something beyond single-prompt chatbots”. Other criminals reject claims of fully autonomous bots that create and fund bank accounts and spin up cloud servers to deploy copies of itself. Given Stage 1, we can assume the threat is legitimate. Most of the publicly available tooling, however, is at best a partially completed framework and likely vaporware (stages 2 and 3 of the threat landing curve).\n\n## What powers an offensive agent\n\nThese stages represent steps in an attack. Below them is a supply chain where an operator purchases parts rather than manufactures them himself. These elements do not, by themselves, represent attacks and are instead picks and shovels. However, they make the acts of subsequent attacker easier to accomplish. Of these picks and shovels, there are three that are most talked about in various forums. These are hands, fuel, and a body.\n\n### Hands – a browser that passes as human\n\nOn 21 September 2026, the individual responsible for the Earnipay hunt, “Trim,” released Pentest2Browser on Exploit.IN. It is a self-hosted “anti-detect” browser layer designed for AI and is currently at Version 0.1.0. It provides access to 89 tools through MCP (Streamable HTTP), REST and CLI. The tools can be used for navigation, challenge solving, and reconstruction. The browser layer can be used to maintain a low FraudScore. As of now, the browser layer is used in conjunction with other automation and proxy services to accomplish tasks requiring interaction with systems that are designed to detect and/or prevent automated checkouts. Pentest2Browser gives the agents the capability to facilitate browsing the web, bringing a person-in-the-browser type interface to the systems, hence giving a checkout and/or fraud prevention system the appearance of a human.\n\n### Body – a runtime with no guardrails\n\nJT AI (openweb, 29 August 2026), advertised as “a browser agent for Chrome, maxed out,” works similarly to commercial browser agents, except that it can be deployed on various models based on the provider (Runpod, Venice, DeepInfra, OpenRouter, etc.) that you direct it to, and some of these models are unrestricted. JT AI performs Reasoning models to plan and code. It seeks far-reaching permissions in Chrome to, for example, manipulate scripts and modify network requests, and access the browser’s debugging and host APIs. It requests permission to access all websites on the Internet. JT AI integrates with the browser and, with the deployed model, becomes an always-on, generally-refusing assistant.\n\n### Fuel – compute and keys to run it in waves\n\nIt costs inference to run an agent in “waves” across hundreds of targets, and that inference is for sale. One auction at Exploit.IN in July 2026 listed hundreds of “production-ready” LLMs and inference credits to facilitate the running of “intelligent AI agents.” Also listed at the auction were LLMs and API keys stolen from large cloud providers. Together the LLMs and inference credits form the tank of an offensive agent, allowing thousands of concurrent targets to be processed without incurring cost or getting rate limited by the agent provider.\n\n## What analysts should take from this\n\nFive operational points, drawn only from the “using” evidence above.\n\n1. **It’s real, but still fairly contained.** The Earnipay dump is verified and selling. The rest is primarily tooling and claims. Address it as an emerging threat, and not as a brcmech. Based on the current state, it should be viewed more as a prevailing-threat. Dismissing it as a fad is unjust.\n2. **Behavior is the true indicator** . Roughly a third of “AI agent” communication on forums is reproduced chatbots, jailbreak prompts and AI-generated phishing messages. Do not consider an incident an “agent attack” solely because it has “agent” written on it. Determine if there has been an autonomous, tool-using, multi-step behavior to achieve a goal with a human setting the goal.\n3. **Consider all your low-hanging fruit to be picked first** . An employee at Earnipay ran an agent across their application and found hardcoded admin tokens in a public bundle. Be proactive and track down your exposure before someone else does. The Earnipay agent scanned faster than the average person. Track down your exposed secrets and public bundles and stale endpoints before someone else’s agent finds them first.\n4. **Offensive capabilities like stealth browsers and no-guardrail runtimes are becoming easier to procure and employ through standard interconnects like MCP** . It’s becoming easier for people to setup and deploy agents. As a result, we should expect the number of agents to increase, not just their capability.\n5. **Dark web visibility is early warning** . A case with no CVEs or press publicly disclosed was only documented with a forum post and evidence of an impending sale. Undocumented incidents involving nation-state actors, such as targeted breaches, are typically first and often only detected by their publication on forums with associated vendor tools and data dumps.\n\n## How Lunar fits in\n\nThis post identifies a number of breaches, and each time it was not a CVE or a vendor disclosure that alerted me. It was a post to a dark-web forum or market. Earnipay is a good example. There is a single, self-written, operator-published disclosure that defined the breach. It was announced with no external disclosure, no press, and no buyer even in the dark web. With dark-web agent monitoring, you are alerted as the operator is announcing the breach, and usually before the victim is even aware. [Lunar](https://lunarcyber.com/) provides agent threat monitoring with dark-web intelligence, and provides real-time indexing of dark-web marketplaces and forums in multiple languages. With Lunar, you can monitor the dark-web for breaches that are being discussed.", "url": "https://wpnews.pro/news/ai-agents-in-the-underground", "canonical_source": "https://lunarcyber.com/blog/ai-agents-in-the-underground-2/", "published_at": "2026-10-28 08:25:08+00:00", "updated_at": "2026-10-28 08:44:55.258398+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "artificial-intelligence"], "entities": ["Earnipay", "OpenCode", "SendGrid", "Stripe", "Twilio"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/ai-agents-in-the-underground", "markdown": "https://wpnews.pro/news/ai-agents-in-the-underground.md", "text": "https://wpnews.pro/news/ai-agents-in-the-underground.txt", "jsonld": "https://wpnews.pro/news/ai-agents-in-the-underground.jsonld"}}