Bitsight found MONST3R-AI, a pentest agent that runs on stolen OpenAI, Anthropic and Google API keys, as 800+ fake AI-skill and MCP repos push SmartLoader.
A Bitsight study published on 15 October 2026 describes a criminal product, MONST3R-AI, that points an autonomous penetration-testing agent at a target list and bills the work to someone else's OpenAI, Anthropic or Google account. The same research notes that more than 800 fake AI-skill and MCP repositories from the FakeGit campaign are pushing the SmartLoader malware, and that underground-forum talk of MCP, AI agents and indirect prompt injection grew 67 percent. Anyone who holds a commercial AI API key, or installs agent skills and MCP servers from public registries, is in scope.
What Bitsight found
Researcher Nethaniel Ribco analysed posts from 16 underground communities between February and August 2026, tracked across ten keyword categories. Overall AI-related discussion rose 45 percent while ransomware mentions fell 49 percent. Phishing mentions fell about 8 percent, and talk of branded malicious LLMs such as WormGPT and FraudGPT about 9 percent. Bitsight attributes part of the ransomware drop to external factors such as law enforcement takedowns. Mentions of "vibe coding" more than doubled, and the 67 percent rise covers MCP, AI agents and indirect prompt injection together. The post does not state the baseline for that comparison, so treat it as a direction of travel rather than a precise measure.
Bitsight's count of underground-forum mentions, February to August 2026. Agent and MCP talk grew fastest; ransomware fell, partly because of law-enforcement takedowns.
MONST3R-AI: bring your own stolen key
MONST3R-AI is marketed on what Bitsight calls a highly restricted forum as an autonomous penetration-testing platform. The seller and the forum are not named, and no price is given. The model is bring-your-own-key: the buyer pastes stolen OpenAI, Anthropic or Google API keys into a panel, sets a budget cap and supplies a target list. The seller hosts no model, the provider's safety training is bypassed, and the API bill lands on the key's owner. Bitsight expects stolen keys to be sold mainly to feed scanners like this one.
The seller claims 1,072 findings across 199 scanned hosts. That is a self-reported dashboard figure, and Bitsight says it could not verify it. The sources do not say what counts as a "finding" or how capable the agent is. Treat the number as the seller's claim.
The practical risk is cost and abuse attribution. A leaked key now has a clear buyer, and its owner funds scans of third parties that trace back to their account.
FakeGit: fake AI skills and MCP servers
Bitsight describes FakeGit as roughly 7,600 fraudulent GitHub repositories spreading SmartLoader, of which more than 800 pose as AI skills or MCP servers, including a lookalike "Docker MCP Gateway." The aim is to get indexed in public AI registries. Bitsight attributes the campaign to the actor Water Kurita. Other reporting is more careful: BleepingComputer, summarising research by Island, calls FakeGit a continuation of an older Lumma Stealer operation that Trend Micro tracked as Water Kurita, and does not confirm the same actor is behind it.
Island's research adds detail. Repository READMEs send visitors to ZIP archives posing as installers, which contain disguised Lua payloads that launch SmartLoader. SmartLoader persists through scheduled tasks, retrieves its command-and-control address from a Polygon smart contract, downloads encrypted stages from GitHub and ends by delivering the StealC information stealer. Island found more than 600 listings linked to the campaign in registries including LobeHub, Glama, MCP.so and MCP Market, and could not tell whether they were submitted by hand or indexed automatically.
GitHub counters showed 14,084,688 download events across 211 repositories, but Island says that includes repeat and automated requests and "should not be interpreted as infections." Island also coined "AgentBaiting" for the technique: in its tests ChatGPT, Gemini and Claude surfaced malicious repositories unprompted. In one limited test Claude Code cloned a malicious repository, then spotted suspicious indicators and stopped before execution. The tests were not designed to measure a detection rate.
What defenders should do
- Scan code, CI and endpoints for exposed Anthropic, OpenAI and Google keys, and treat a leak like an exposed AWS credential. Set spend limits and alerts on every key, and rotate on any sign of exposure.
- Verify the provenance of every MCP server, coding-assistant extension and agent plugin. Keep an approved catalogue and test new capabilities in isolation.
- Run local coding agents with least privilege: no access to sensitive directories, and human approval for arbitrary shell commands.
- Baseline human login rates on platforms such as Notion, Slack and GitHub; agents driving headless browsers operate at a different cadence.
- If SmartLoader execution is suspected, rotate all secrets in the affected environment immediately.
Caveats
The MONST3R-AI figures are the seller's, the 67 percent has no stated baseline, and forum chatter measures interest, not confirmed attacks. Bitsight names Water Kurita as the FakeGit actor; the Island-based reporting stops at "continuation of" an older operation.