Bitsight's monitoring of 16 underground forums found a 67 percent rise in chatter about AI agents, indirect prompt injection, and the Model Context Protocol between February and August 2026. The attention is not theoretical: a seller is marketing MONST3R-AI, an autonomous scanner that runs on stolen API keys from OpenAI, Anthropic, and Google. The buyer pastes the keys into a panel, sets a spending cap, and points the tool at targets; the legitimate key owner absorbs the cost.
MONST3R-AI's seller claims 1,072 findings across 199 hosts, but Bitsight could not verify that figure. The researchers argue that even a small accurate share would make the tool effective. Two groups are particularly exposed: companies that leak an AI provider key end up financing attacks on other systems, and engineering teams that install agent plugins from public registries can pull in malware disguised as a useful tool.
Jailbreaking remains the dominant forum topic, with discussion up roughly three quarters. Mentions of open-weights models such as GLM and DeepSeek climbed sharply, since these can be run on rented servers with no provider oversight. Some members remove safety behavior themselves, a technique called abliteration. Meanwhile, ransomware talk fell 49 percent and phishing 8.5 percent, though takedowns and closed channels likely explain part of the decline.
One campaign, FakeGit, attributed to the actor Water Kurita, used roughly 7,600 fraudulent GitHub repositories to spread SmartLoader malware; more than 800 of those posed as AI skills or MCP servers, including a lookalike 'Docker MCP Gateway.' Bitsight advises treating exposed AI provider keys like AWS credentials, verifying every MCP server and agent plugin, and requiring human approval for local coding agents that touch sensitive directories or shell commands.