A seller on a restricted criminal forum is marketing an autonomous hacking tool that runs on stolen OpenAI, Anthropic and Google API keys, so the key’s owner pays for the scans. Bitsight’s threat intelligence team tracked the shift across thousands of posts on 16 underground forums from February through August 2026. Over that window, mentions of AI agents, indirect prompt injection and the Model Context Protocol (MCP) rose 67 percent. Two groups are exposed. A … More
The post Stolen AI API keys are paying for hackers’ autonomous scans appeared first on Help Net Security.
source & further reading
helpnetsecurity.com — original article
New infosec products of the week: October 16, 2026
ServiceNow gives AI agents a passport, and limits on what they can do
Optro automates GRC workflows with auditable AI agents