Stolen AI API keys are paying for autonomous attack scans, and an Archon flaw exposes AI coding agents: what developers should check

Update, October 22, 2026: Wiz says AWS credentials stolen in the LiteLLM 1.107.0 compromise on October 21, 2026 were tested against Amazon Bedrock about 4.5 hours later. See the LiteLLM 1.107.0 compromise.

Stolen AI API keys now have a second use beyond free chat: running attacks. In a report published October 15, 2026, the security firm Bitsight said criminals are selling MONST3R-AI, an autonomous hacking tool that runs on stolen OpenAI, Anthropic and Google keys, so the victim whose key was stolen pays for the scans. Also on October 15, a critical-rated security flaw, CVE-2026-111322, showed that Archon, an open-source tool for running AI coding agents, leaves its control API open without a login by default. Both stories point to the same thing for developers: AI keys and agent control planes are now targets in their own right.

This story is based on Bitsight's report, Help Net Security's October 16 coverage, VulnCheck's CVE advisory, the researcher's write-up, Archon's documentation, security policy and source, and Anthropic's and OpenAI's API key guidance, checked October 18, 2026.

The short version

• MONST3R-AI: a "bring your own key" autonomous pentest platform sold on a restricted forum. Buyers supply stolen OpenAI, Anthropic or Google keys, set a budget cap and give the agent targets, according to Bitsight.
• Who pays: "the API bill lands on the victim whose key was stolen," Bitsight says.
• Archon CVE-2026-111322: Archon 0.2.13 through 0.11.1 exposes its /api/* control API on all network interfaces with no authentication by default, per VulnCheck. Severity is disputed: critical per VulnCheck, high per the researcher.
• No confirmed Archon patch: as of October 18, Archon's GitHub security page lists no advisory, and no fixed version has been named. Archon shipped v0.12.0 and v0.12.1 on October 17, but their release notes don't mention the flaw.
• What to do: find and revoke exposed AI keys, cap spending, and make sure agent tools listen only on localhost or sit behind authentication.

What is MONST3R-AI?

Bitsight staff researcher Nethaniel Ribco describes MONST3R-AI as "an autonomous AI penetration testing platform" marketed on a highly restricted forum. The seller hosts no model. Buyers paste stolen API keys from OpenAI, Anthropic or Google into a control panel, set a budget cap and point the agent at a list of targets. Bitsight's report includes screenshots of the key panel.

The design matters for two reasons, according to Bitsight. First, the attacker doesn't need a jailbroken or criminal model: "the provider's safety training is bypassed architecturally," Bitsight writes, because the tool drives mainstream models through ordinary API calls. Second, the cost falls on whoever owns the key.

The seller claims "1,072 findings across 199 scanned hosts." Bitsight calls that "a self-reported dashboard figure we cannot independently verify." Bitsight says stolen AI provider keys are "actively traded" on underground forums, but doesn't say how they're obtained. It doesn't name any victim company, and neither OpenAI nor Anthropic had commented on MONST3R-AI in the coverage as of October 18.

What else did Bitsight find?

Bitsight reviewed thousands of posts across 16 underground forums from February through August 2026, tracking keyword mentions. Its author notes that keyword counts are an imperfect measure. The headline numbers, all from Bitsight:

Bitsight also cites a campaign it attributes to an actor called Water Kurita, which used about 7,600 fraudulent GitHub repositories to spread SmartLoader malware; more than 800 posed as AI "skills" or MCP servers. One forum actor showed an AI agent using the IDA Pro disassembler to find a buffer overflow and draft an exploit plan. For background on how agents get hijacked through the content they read, see our prompt injection explainer.

What is the Archon vulnerability?

Archon is an open-source tool, maintained in the coleam00/Archon GitHub repository, that runs AI coding workflows and agents with a web UI and chat integrations. Its own security documentation says it runs the Claude Code SDK in bypassPermissions mode, which "grants full file and shell access," and warns not to expose it "to untrusted users without adapter-level authorization."

VulnCheck's advisory for CVE-2026-111322, dated October 15, 2026, says Archon 0.2.13 through 0.11.1 "contains a missing authentication vulnerability" that lets unauthenticated attackers reach the /api/* control API, "which binds to 0.0.0.0 by default." It says attackers can send messages to the AI coding agent, which runs with bypassPermissions, to run commands on the host. VulnCheck classifies it as CWE-306 (missing authentication for a critical function) and rates it critical, 9.3 under CVSS 4.0.

The researcher credited in the advisory, who publishes as hieuPenguinnn, describes it more narrowly. Their write-up says the gate that protects the API only turns on when an operator configures both a Postgres DATABASE_URL and a BETTER_AUTH_SECRET, so a default SQLite install has no login. An attacker on the network could start workflow runs, inject messages into agent conversations, approve or reject paused agent actions, and connect or replace provider keys. But the write-up says "this is not remote code execution on the host," rates it high, and states that "runtime validation was NOT performed": the finding comes from reading the v0.11.1 source.

The two descriptions differ on how directly an attacker gets code execution, not on the missing login. With an agent that has full shell access and no approval prompts, the line between steering the agent and running commands is thin. That's the risk our case against unattended agents describes.

Is there a fix for Archon?

Not a confirmed one as of October 18, 2026. Archon's GitHub security page says "There aren't any published security advisories," and neither VulnCheck nor the researcher names a fixed version. The NVD entry and GitHub's unreviewed advisory GHSA-3q7p-hhhj-qh4p repeat VulnCheck's description and list no patched version. VulDB, which also lists the CVE, says "no mitigation known."

Archon did ship new versions after the disclosure: v0.12.0 and v0.12.1, both on October 17. Their release notes don't mention CVE-2026-111322 or a change to the default bind address or login. In the v0.12.1 source, the server still defaults to 0.0.0.0 when HOST isn't set, and web auth is still "OFF by default" unless both a Postgres DATABASE_URL and a BETTER_AUTH_SECRET are set. Archon hasn't said whether 0.12 addresses the flaw, so treat it as unfixed and apply the steps below.

Archon's security policy asks people to report vulnerabilities privately and says public deployments should sit behind the Caddy reverse proxy with authentication, as configured in its deploy/docker-compose.yml.

Archon's own docs and the researcher's write-up point to these steps until a release fixes the default:

1. Check what it listens on. The researcher notes the server binds to port 3090 on all interfaces by default. If it answers from another machine, it's exposed.
2. Bind to localhost. Archon's .env.example says to set 127.0.0.1 to restrict it, and its security docs suggest binding the app to 127.0.0.1. In Docker, publish the port on loopback only.
3. Turn on authentication. Archon's docs say that when web auth is enabled, "every /api/* request needs a session/identity or gets 401." That requires PostgreSQL with Better Auth configured. Don't set ARCHON_WEB_AUTH_REQUIRED=false unless an authenticating proxy is in front.
4. Put a proxy in front of shared deployments, as Archon's security policy recommends.
5. Rotate provider keys if an instance was reachable from the internet, since the write-up says an attacker could change connected provider keys.

Exposed AI tools are a pattern: the PoeLLM botnet spread through internet-facing LiteLLM and Ollama servers.

How do I check whether my AI API keys are exposed?

Bitsight's advice is to treat leaked Anthropic, OpenAI and Google keys "with the same urgency" as leaked AWS credentials. The providers' own guidance covers the mechanics:

• Revoke and replace. Anthropic says to revoke a compromised key "immediately" from the Claude Console. OpenAI says to "rotate your key immediately from the API Keys page" and update applications that use it.
• Watch usage and cap spend. Anthropic recommends reviewing logs and usage regularly; organizations with custom rate limits can set spend limits. OpenAI recommends monthly spend limits with hard enforcement, noting that "spend alerts alone don't stop API traffic."
• Scan your code. Anthropic is part of GitHub's secret scanning partner program: when a Claude API key appears in a public GitHub repository, "Anthropic automatically deactivates the exposed API key" and emails the owner. Anthropic also recommends secret scanning in your own repositories and CI.
• One key per use. Separate keys for each tool, environment or agent limit the damage when one leaks. OpenAI also recommends keys with expiration dates.
• Know where third parties store your keys. Hosted gateways that hold your keys concentrate risk, as the OpenCode breach showed on October 17, when OpenCode said provider keys saved in its Console may have been exposed.

Why it matters

Agents change what a stolen key is worth. A leaked key used to mean someone else's chatbot bill; Bitsight's report describes keys funding automated attacks on third parties. And tools that run agents with full permissions, like Archon, turn an unauthenticated API into a way to steer an agent that can touch your files and shell. Review tooling (see how the Claude Code team reviews code) doesn't help if the agent's control plane is open. Separately, OpenAI's own disclosures show how far agents can reach when nobody is watching; see our explainer on OpenAI's rogue AI agents.

What's confirmed, reported and uncertain

• Confirmed (primary sources):
  • Bitsight's description of MONST3R-AI and its forum statistics (Bitsight report, October 15)
  • CVE-2026-111322's description, affected range and VulnCheck's critical rating (VulnCheck, October 15)
  • Archon's bypassPermissions mode, its auth configuration and its lack of a published advisory (Archon docs and GitHub)
  • Archon v0.12.0 and v0.12.1, released October 17, don't mention the CVE in their release notes; NVD and GitHub's advisory list no patched version
  • Anthropic's and OpenAI's key revocation and monitoring guidance
• Claimed, unverified:
  • MONST3R-AI's "1,072 findings across 199 scanned hosts" (the seller's own figure)
  • the Archon impact chain, which the researcher derived from source code without a live test
• Disputed: whether CVE-2026-111322 amounts to direct remote code execution (VulnCheck) or agent control short of host RCE (researcher).
• Uncertain:
  • how MONST3R's stolen keys were obtained, and whether any came from the OpenCode breach (no source links them)
  • whether Archon 0.12 changes anything relevant to the flaw, and when a fix will ship