Hackers use stolen AI API keys to fund autonomous scans

Threat researchers have identified a criminal tool that conducts AI-assisted network scans using stolen provider API keys. The tool automatically charges usage costs to the accounts of compromised key holders while running autonomous reconnaissance operations on their behalf.

Security teams should scan code repositories and configuration files for exposed API keys to prevent unauthorized access. Organizations are advised to verify all plugins and Model Context Protocol servers integrated into their environments, as these can be vectors for key extraction and misuse.

Teams managing AI agents should require explicit approval before those agents are permitted to access sensitive internal systems. This control limits the potential damage if an agent or its associated keys are compromised by an external actor.