Criminals Run AI On Stolen Keys. Some Insurers Now Cap The Bill.

Estimated reading time: 5 minutes

Bitsight found a criminal hacking platform that runs on AI API keys stolen from legitimate companies. The key’s owner pays for the attack. Some cyber insurers have started setting smaller limits for exactly that loss.

Bitsight researchers found a hacking platform for sale on a restricted cybercrime forum. It runs on stolen API keys from other people’s AI accounts.

The tool, MONST3R-AI, is an autonomous AI penetration testing platform. A buyer pastes in API keys stolen from OpenAI, Anthropic, or Google customers. The buyer then sets a budget cap and points the agent at a list of targets.

“The API bill lands on the victim whose key was stolen,” Bitsight wrote in a 15 October blog post.

The seller claimed 1,072 findings across 199 scanned hosts. Bitsight said it could not verify the figure.

Bitsight’s threat intelligence team found the platform while analyzing thousands of posts across 16 underground forums, from February through August. It expects this “bring your own key” model to spread among lower-skilled criminals. It also expects more marketplaces selling stolen API keys.

Bitsight sells security ratings and threat intelligence, and some insurers use its ratings in underwriting. The team ran the research on Bitsight’s own MCP server and threat-hunting API.

Stolen API Keys Already Carry A Price Tag

Security firm Sysdig named the practice “LLMjacking” in 2024. Attackers used stolen cloud credentials to run AI models on victims’ accounts.

Sysdig estimated a victim could face more than $46,000 a day in charges. For top-tier models, it put the figure above $100,000 a day. “An entire market and ecosystem has developed around access to LLMs,” Sysdig wrote.

Keys leak from many places. Censys counted almost 114,000 n8n automation servers open to the internet, as Cyber Insurance News reported this week. n8n stores the credentials it uses to reach AI models and other systems.

How Cyber Insurance Treats Stolen API Keys

Some cyber policies already cover this kind of loss. Coalition’s Service Fraud coverage pays direct financial losses when criminals run up charges on an insured’s “cloud- and Internet-based services.” Its help pages say a sublimit may apply.

Insurers have also started to name the risk. In April, the Financial Times reported that QBE had introduced sublimits for LLMjacking. On a policy with $5 million of cover, the LLMjacking limit would be around $250,000.

Beazley proposed terms to limit some AI-related losses, the FT reported. Beazley said those amendments were “still being developed” and not yet in active policies.

QBE said it was “not retreating” from AI risks. An AI event that leads to a conventional cyber incident stays within the core policy, it said.

Assured, a London cyber managing general agent, read the sublimits as clarity. Most cyber policies do not explicitly cover LLM-jacking today, Assured wrote. It knew of no insurer denying a cyber claim because AI was involved.

Many wordings still say nothing. RAND found most carriers silent on AI losses in their filings, as Cyber Insurance News reported. Insurance Business reported in September that most Australian cyber wordings carry no AI-specific language.

For buyers, three questions follow. Does the policy’s service fraud or cryptojacking cover name AI services? Do usage charges count as a direct loss? And what sublimit applies?

What Else Bitsight Found In Malicious AI Chatter

AI-related discussion grew 45% across the forums Bitsight tracked. Mentions of MCP, AI agents, and indirect prompt injection grew 67%.

Ransomware mentions fell 49% and phishing mentions 8%. Bitsight says law enforcement takedowns and moves to closed channels may explain part of the ransomware drop. Mentions track discussion, so the fall says little about attacks. Bitsight calls keyword tracking “an imperfect measure.”

At least a third of the forums have created dedicated AI sections, Bitsight found. Capable criminals rent GPU servers to run open-weights models, such as GLM, DeepSeek and Kimi, with safety controls stripped out.

Forum members are also studying attacks on AI developer tools. In the FakeGit campaign, roughly 7,600 fraudulent GitHub repositories spread SmartLoader malware, BleepingComputer reported. More than 800 posed as AI skills or MCP servers.

Watching these forums is a business of its own. Jonathan Palmer, CEO of CDL Cyber Intelligence, explained how it works on the Cyber Insurance News podcast.

Bitsight’s first recommendation for defenders is direct. Treat an exposed AI provider key with the same severity as an exposed AWS credential.

FAQ – Stolen API Keys

What is LLMjacking?

Criminals using stolen credentials or API keys to run AI models on someone else’s account. Security firm Sysdig named it in 2024.

How much can stolen API keys cost a company?

Sysdig estimated more than 46,000 dollars a day in charges, and over 100,000 dollars a day for top-tier models.

What did Bitsight find?

A hacking platform, MONST3R-AI, where buyers paste in stolen OpenAI, Anthropic or Google API keys. The key’s owner pays for the attack.

Does cyber insurance cover a stolen API key bill?

It depends on the wording. Some policies cover fraudulent use of cloud services. QBE has introduced LLMjacking sublimits, the Financial Times reported.

Is ransomware declining on criminal forums?

Ransomware mentions fell 49 percent across the forums Bitsight tracked. Bitsight says takedowns and moves to closed channels may explain part of that.

How should companies protect AI API keys?

Bitsight advises scanning for exposed AI keys and treating one as seriously as an exposed AWS credential.

Related Cyber Insurance Post

• If Attackers Test You Every Day, Why Does Your Insurer Test You Once A Year?
• Deepfake Protection: Reality Defender’s API Now Available(Opens in a new browser tab)
• Bitsight Launches AI Cybersecurity Tool to Accelerate Vendor Risk Assessments(Opens in a new browser tab)
• Cyber Insurance Technology & Services Growing Faster than Premiums? Bitsight Results Raise Question(Opens in a new browser tab)
• Insurers Filed Deepfakes Under Cybersecurity. The Risk Walked Into The Claims File.(Opens in a new browser tab)