AI-generated article. This article was researched and drafted using AI tools and published automatically, and its featured image was generated by AI. Facts are drawn from the sources cited in the text.
Most small businesses now hold a short string of characters that behaves like a payment method, and almost nobody in the building can say where it lives. It sits in a Zapier connection, or a .env file on a contractor’s laptop, or a hosted dashboard somebody signed up for in March and has not opened since. Stolen AI API keys are the reason that matters this month. Inside the same 48 hours, two unrelated stories made the same point from opposite directions: when one of those strings gets out, the bill goes to whoever owns it.
Not the attacker. The owner.
A hacking tool designed to bill the victim
Bitsight’s threat intelligence team spent February through August 2026 reading thousands of posts across 16 underground forums. Its report describes a product called MONST3R-AI, marketed on a tightly restricted forum as an autonomous penetration testing platform. The design is the part worth noticing. The seller hosts no model at all. A buyer pastes in a stolen OpenAI, Anthropic or Google key, sets a budget cap, points the agent at a list of targets, and lets it run. Bitsight is blunt about where the cost lands: the victim whose key was taken pays the API bill.
The seller’s dashboard claims 1,072 findings across 199 scanned hosts. Bitsight says plainly that it could not verify that figure, and the honest reading is that a criminal seller’s marketing copy is still marketing copy. The mechanism is the verified part, and the mechanism does not need the claim to be true.
Bitsight’s wider counts show where attention is moving. Across those forums, mentions of AI agents, the Model Context Protocol and indirect prompt injection rose 67%. General AI discussion rose 45%. Ransomware mentions fell 49%. At least a third of the platforms have opened dedicated AI subforums.
Why stolen AI API keys are not like a stolen password
A stolen password gets someone into an account, where there is usually a login alert, a session to revoke and a human who eventually notices something odd. A key is different in a way worth sitting with. It is metered. It bills by the token, it has no face attached, and often the only thing standing between it and an unbounded invoice is a spending limit the owner never set.
The resale market has already priced that in. Help Net Security reported a reseller called CloseRouter advertising access at roughly ten cents per million tokens, listing GLM at $0.053 per million input tokens against $1.12 on the official API. Google’s Threat Intelligence Group found underground prices for stolen Claude, Gemini and Cursor Pro accounts more than doubled through 2026. SpyCloud’s 2026 Identity Exposure Report counted 18.1 million exposed API keys and tokens, 6.2 million of them tied to AI tools, and named the structural problem directly: these credentials rarely carry multi-factor authentication, rarely rotate, and often hold broad permissions. Bitsight’s first recommendation is to treat an exposed AI provider key as seriously as an exposed AWS credential, which is not how most organizations currently file it.
The second story is the ordinary one
Overnight on October 16, OpenCode, an AI coding agent platform, was breached. The company said on October 17 that what it calls a large scale distillation attack affected 1.4% of OpenCode Console users, specifically the subset who had stored OpenAI, Anthropic or Google keys in the product. It emailed those users, said it was working with all three providers on remediation.
Nobody did anything careless by using OpenCode. That is the point. The keys were stored where the product asked for them to be stored. Most small businesses sit one layer further out again, with keys parked in tools chosen by a freelancer who has since moved on, which is a quieter version of the same question about what an AI agent is permitted to reach.
What a business with three automations and no security team can do
The tempting conclusion is that all of this is a reason to be more careful with AI, which in practice means slower, which in practice means nothing changes. That reading is wrong. The more useful frame is that an AI key is a financial control rather than a technical one, and financial controls are something a business owner already knows how to run.
So the first step is not a security review. It is a list. Where do the AI keys live, which tools hold them, and who created each one. Twenty minutes with a notepad gets most businesses further than a policy document would.
Then set a hard spending limit on every key, in the provider’s own dashboard. That single move converts an open-ended liability into a number somebody chose. It takes about ten minutes and it is the highest-value item here. After that, check usage history back to mid-October for models, hours or volumes that do not look like the business, and reissue anything sitting in a tool nobody opens anymore.
Three small jobs, and the first is only looking. Anyone who does the list this week is on a good path, even if the caps wait until next month.
The harder question is still open. As more of this work shifts to agents that run without anyone watching and hold live credentials to do it, and as regulators start asking what happens when one goes further than its owner intended, who in a five-person company is actually supposed to own the keys?
