Steal the Key, Skip the Jailbreak — Bitsight Charts the Underground’s Move From Chatbot Tricks to Agent Infrastructure

2026-10-17 Agent & Supply Chain Security by al-ice.ai Editorial

Most public discussion of AI-enabled cybercrime is, in Bitsight’s polite phrasing, vendor marketing and speculation about future capabilities. Its threat-intelligence team decided to measure what criminal practitioners are actually doing instead: thousands of posts across 16 underground communities — from stolen-consumer-account resale boards to technically advanced Russian-language hacking forums — tracked from February through August 2026 across ten keyword categories, with the highest-signal hits cross-referenced against public reporting. The resulting report, “The New Frontier of Malicious AI,” published 15 October 2026, describes a decisive shift: the underground is moving past basic chatbot manipulation toward autonomous agents, open-weights models, and productized attack infrastructure. And there is a methodological wink worth noting — the team ran the analysis through the Bitsight MCP server and Threat Hunting Intel Items API, querying the data conversationally. They used MCP to study criminals coming for MCP.

The headline numbers come with a control baseline, which is what makes them worth quoting. Mentions of traditional cybercrime keywords fell on the same forums over the same window — ransomware down 49%, phishing down 8% — while AI-related discussion grew 45% and mentions of MCP, AI agents and indirect prompt injection grew 67%. Bitsight is honest that keyword tracking is an imperfect measure and that the ransomware drop partly reflects takedowns and migration to closed channels, but the divergence is the signal: criminal attention is migrating toward AI tradecraft faster than general forum activity can explain.

Jailbreaks are the entry tier now — open weights are the workshop

Jailbreaking remains the single largest category tracked, but the vocabulary has turned over completely: the named prompt tricks of 2023 are extinct. What replaced them is a competence hierarchy. Actors on prominent Chinese- and Russian-language boards now rank models by how readily they comply without triggering guardrails, and the capable operators are moving the work in-house — renting GPU servers to run locally modified, safety-stripped open-weights models, with abliteration (stripping safety behaviour out of the weights themselves) done as a matter of routine. Mentions of GLM, DeepSeek and Kimi climbed sharply. The enforcement logic is stated plainly in the report: open weights remove the entire enforcement surface — no provider-side safety layer, no usage logging, no bannable account. Meanwhile mentions of “vibe coding” more than doubled, but in elite circles the phrase functions as a pejorative status boundary — premium tools are marketed as hand-crafted, explicitly separating low-skill AI reliance from serious weaponized development.

The commoditization layer is already visible in price lists. A reseller operating as CloseRouter advertised flat-rate access to DeepSeek, MiniMax, Qwen, GLM and other open-weights models alongside ChatGPT, Claude and Gemini at around ten cents per million tokens — with Help Net Security noting a GLM price of $0.053 per million input tokens against $1.12 from the official API. And the branded malicious-LLM market looks saturated rather than shrinking: mentions of WormGPT, FraudGPT, GhostGPT, DarkGPT and EvilGPT fell 9%, almost exactly the background rate of forum chatter decline. The telling detail is what happened to WormGPT itself — breached earlier this year, exposing roughly 19,000 users’ emails, payment data, subscription tiers and unique identifiers. A criminal SaaS company got breached like a legitimate one, complete with subscription tiers. Discussion plateaued; the customer base did not.

The structural evidence is stronger than the keywords

Keyword counts fluctuate week to week, so the report’s most compelling evidence is architectural: at least one-third of the analyzed platforms have created dedicated standing subforums for AI discussion — jailbreaks, neural networks, agent hijacking — across top-tier Russian technical communities, Turkish-language boards and consumer resale forums alike. Modifying forum structure requires an administrative decision in response to sustained demand. AI tradecraft is now institutionalized furniture in the cybercrime economy, not a trending topic.

The most sophisticated artifacts came from specialized reverse-engineering communities, not leak boards. One reputable actor demonstrated an AI agent integrated with IDA Pro automatically analyzing code, identifying a buffer overflow and drafting a complete exploit plan. Another showed a general-purpose agent with browser-automation capabilities breaching an enterprise Notion account — the headless-browser cadence defenders should be baselining for, since it looks nothing like human login rates. Forum members are also actively dissecting real supply-chain operations: the FakeGit campaign attributed to “Water Kurita,” in which roughly 7,600 fraudulent GitHub repositories distributed SmartLoader malware with over 800 disguised as AI skills or MCP servers — including a lookalike “Docker MCP Gateway” built to get indexed in public AI registries — a technique the report labels agentbaiting and flags for copycat risk. The same section names the Shai-Hulud npm worm family, which the report describes as weaponizing Claude Code session hooks, alongside the Megalodon repository-backdooring campaign. Readers of this site have seen both: our July FakeGit briefing and our Mandiant hijacked-assistant case study cover the same ground from the victim side.

MONST3R-AI: the bill lands on the victim

The report’s sharpest exhibit is MONST3R-AI, an autonomous penetration-testing platform marketed on a highly restricted forum. The seller hosts no model at all. The buyer pastes stolen OpenAI, Anthropic or Google API keys into a panel, sets a budget cap, and unleashes the agent on a target list. Provider safety training is bypassed architecturally — there is nothing to jailbreak when the key is legitimate — and the API bill lands on whoever owned the key. The seller claims 1,072 findings across 199 scanned hosts, a dashboard figure Bitsight explicitly says it cannot verify, adding that even a small accurate share would make the tool effective. The forecast that follows is the one to take seriously: Bitsight expects stolen keys to be sold purely to fuel scanners like this one, with BYOK productization going mainstream among lower-skill actors for whom renting victim-funded commercial inference is cheaper than any infrastructure of their own. Key theft and compute theft collapse into a single transaction — the victim pays for the attack twice, once in exposure and once in invoice.

That forecast is why the report’s closing prediction matters more than any single percentage: agents over models. The underlying model will matter less than the harness wrapped around it, and a market built around commodity open-weights models on rented hardware feeding custom agent harnesses has no brand to watch. Tracking WormGPT gave defenders a rough read on activity; a diffused build economy offers no such handle. It is, the report notes, exactly the segment that grew fastest.

The supply side leaked the same week

While criminals industrialize demand for other people’s keys, the supply keeps arriving unforced. Fireworks AI, an inference provider, disclosed that on 6 October it found unauthorized use of internal credentials that let a third party reach environment variables in evaluation jobs across a limited number of customer accounts — including API keys and tokens stored as secrets — with no evidence of further misuse found so far, as reported by Resilient Cyber’s newsletter and VentureBeat on 16 October. VentureBeat adds that Fireworks completed one credential review four days after detection with more rotation still underway. This is the inventory MONST3R-AI’s buyers shop from: provider-side keys, eval-job secrets, the credentials teams forget they issued.

VentureBeat’s September 2026 Agentic Security and Identity survey of 102 enterprises explains why that inventory stays stocked. Forty respondents described an enforcement program — and 17 of those 40 then admitted some or most of their agents still share credentials. Only 14 of 102 said they could revoke an agent’s access within minutes; 40 reported a confirmed agent security incident or near-miss in the past year. The revocation finding is the structural one: a shared credential authenticates the request without identifying which agent sent it, so withdrawing one agent’s access without breaking the others is frequently impossible — and NIST and CISA’s September Interagency Report 8587, recommending access tokens live no more than an hour, covers signed tokens and assertions, a class static API keys do not belong to. The world Bitsight measured runs on exactly the credential class enterprises cannot revoke and providers keep leaking.

What to do

Treat an AI provider key like an AWS secret key. Scan for exposed OpenAI, Anthropic and Google keys with the same tooling and urgency as cloud credentials — Bitsight’s two exposed groups are the key leaker (who funds attacks on strangers) and the plugin installer (who imports the malware). Both are key-management failures first.
Time your own revocation. Pick one production agent and measure how long it takes to withdraw its access without touching any other workload. If the answer starts with tracing which shared key it uses, the inventory is the containment problem — 22 of VentureBeat’s 102 respondents could not say how their agents authenticate.
Verify every MCP server and agent plugin source. FakeGit’s 800-plus disguised skills and servers were built to be indexed where agents shop. Pin registries, hash artifacts, and treat a skill install with dependency-grade suspicion.
Baseline machine cadences on collaboration tools. Browser-automation agents driving Notion, Slack and GitHub work at a distinct rhythm from humans. Human login-rate baselines are the tripwire Bitsight’s own recommendations point at.
Assume open-weights abuse is unobservable upstream. There is no provider log, no ban, no safety refusal to detect — abliterated models on rented GPUs leave no signal at the model layer. Detection has to live at the action layer: egress, execution, and spend.
Watch the bill, not just the logs. A BYOK scanner spending a stolen key shows up first as anomalous inference spend on the victim’s invoice. Billing alerts per key, per project, with caps, turn the victim-pays model into an early warning.

Verification note: forum counts, window, methodology, the MCP-server analysis detail, the +45%/−49%/−8% baseline, the 67% MCP/agent figure, the open-weights and abliteration findings, the one-third subforum figure, the IDA Pro and Notion cases, the FakeGit and Shai-Hulud references, the MONST3R-AI panel description with its unverified seller claim, and the agents-over-models forecast all come from Bitsight’s “The New Frontier of Malicious AI” (15 October 2026, Nethaniel Ribco), which we read directly. The CloseRouter $0.053-versus-$1.12 comparison comes from Help Net Security’s 16 October summary, which we also read. The Fireworks disclosure is reported via VentureBeat (Louis Columbus, 16 October 2026) and corroborated by Resilient Cyber newsletter #118, both read directly; we did not see Fireworks’ own bulletin, which we could not locate on its public site, and we make no claim about its exact wording. Survey figures are VentureBeat’s September 2026 respondent data as reported in that article. We deployed nothing, contacted no forum, bought nothing, and verified no seller claim.

Sources: