Underground Forum Study Finds Rising Interest in AI Agents and Open-Weight Models
Summary
Bitsight analyzed thousands of posts across 16 underground communities and found rising discussion of AI tradecraft, especially agents, open-weight models, and attack infrastructure, alongside declines in ransomware and phishing mentions.
Key points
- Bitsight analyzed posts from 16 selected underground communities from February through August 2026, tracking keyword mentions across ten categories and comparing AI discussion with ransomware and phishing.
- AI-related discussion rose 45%, while ransomware mentions fell 49% and phishing mentions fell 8%; the article cautions that mention counts are an imperfect measure of activity.
- The study describes growing interest in open-weight models and locally modified models, alongside a shift toward AI agents, MCP, and indirect prompt injection; mentions of these latter topics rose 67%.
- Forum examples included an AI agent using IDA Pro to identify a buffer overflow and plan an exploit, and an actor demonstrating browser automation to breach an enterprise Notion account.
- The article discusses FakeGit, which reportedly used about 7,600 fraudulent GitHub repositories to distribute SmartLoader; over 800 were disguised as AI skills or MCP servers.
- A seller's MONST3R-AI dashboard claimed 1,072 findings across 199 hosts; Bitsight said it could not independently verify the figure. The platform was described as using buyers' provider API keys.
- Recommended defenses include scanning for exposed AI API keys, verifying MCP and plugin provenance, limiting agent permissions, and monitoring for anomalous automated activity.
Article Details
- Publisher
- Bitsight
- Report Period
- February–August 2026
- Scope
- Analysis of AI- and cybercrime-related discussion across 16 selected underground communities, using ten functional keyword categories.
- Sample Size
- Thousands of posts
- Key Statistics
- AI-related discussion grew 45% across the surveyed forums during the study period.
- Ransomware mentions declined 49% and phishing mentions declined 8% over the same period.
- Mentions of MCP, AI agents, and indirect prompt injection grew 67%.
- At least one-third of the analyzed cybercrime platforms had dedicated AI discussion subforums.
- The article reports that roughly 7,600 fraudulent GitHub repositories distributed SmartLoader malware, with over 800 disguised as AI skills or MCP servers.
- Recommendations
- Aggressively scan for exposed AI API keys and treat them with the severity of exposed AWS credentials.
- Verify the provenance of MCP servers, coding-assistant extensions, and agent plugins.
- Apply least-privilege access to local agent harnesses and require human approval before sensitive directory access or arbitrary shell execution.
- Baseline normal human interaction rates and tune rate-limiting and behavioral analytics to detect anomalous agent-driven authentication attempts.
Threat Actors
Malware
Shai-Huludrisk for copycat attacks targeting AI tool registries. Other campaigns similar to FakeGit, the Shai-Hulud npm worm family (which weaponizes Claude Code session hooks), and the Megalodon repository-backdooringSmartLoaderthe actor "Water Kurita"). In that campaign, roughly 7,600 fraudulent GitHub repositories distributed SmartLoader malware — with over 800 disguised as AI "skills" or MCP servers (such as a malicious lookalike "Docker
Vendors
AnthropicInstead of hosting a malicious model, the seller built a panel where the buyer pastes in stolen OpenAI, Anthropic, or Google API keys, sets a budget cap, and unleashes the agent on a target list. The provider's safetyGooglea malicious model, the seller built a panel where the buyer pastes in stolen OpenAI, Anthropic, or Google API keys, sets a budget cap, and unleashes the agent on a target list. The provider's safety training isOpenAIInstead of hosting a malicious model, the seller built a panel where the buyer pastes in stolen OpenAI, Anthropic, or Google API keys, sets a budget cap, and unleashes the agent on a target list. The provider's safety
Products
ChatGPTadvertised flat-rate access to DeepSeek, MiniMax, Qwen, GLM, and other open-weights models alongside ChatGPT, Claude, and Gemini, all around ten cents per million tokens, with no distinction drawn between aClaudeflat-rate access to DeepSeek, MiniMax, Qwen, GLM, and other open-weights models alongside ChatGPT, Claude, and Gemini, all around ten cents per million tokens, with no distinction drawn between a legitimate APIDarkGPTMentions of established, branded malicious LLMs — WormGPT, FraudGPT, GhostGPT, DarkGPT, and EvilGPT — fell 9 percent across our forum set. That's almost exactly the 8 percent decline we measured for the “phishing”DeepSeekWe observed sharp growth in mentions of open-weights models like GLM, DeepSeek, and Kimi. Rather than buying "uncensored" APIs, capable operators are renting GPU servers to run locally modified, safety-stripped models,EvilGPTMentions of established, branded malicious LLMs — WormGPT, FraudGPT, GhostGPT, DarkGPT, and EvilGPT — fell 9 percent across our forum set. That's almost exactly the 8 percent decline we measured for the “phishing”FraudGPTMentions of established, branded malicious LLMs — WormGPT, FraudGPT, GhostGPT, DarkGPT, and EvilGPT — fell 9 percent across our forum set. That's almost exactly the 8 percent decline we measured for the “phishing”Geminiaccess to DeepSeek, MiniMax, Qwen, GLM, and other open-weights models alongside ChatGPT, Claude, and Gemini, all around ten cents per million tokens, with no distinction drawn between a legitimate API pass-throughGhostGPTMentions of established, branded malicious LLMs — WormGPT, FraudGPT, GhostGPT, DarkGPT, and EvilGPT — fell 9 percent across our forum set. That's almost exactly the 8 percent decline we measured for the “phishing”GLMWe observed sharp growth in mentions of open-weights models like GLM, DeepSeek, and Kimi. Rather than buying "uncensored" APIs, capable operators are renting GPU servers to run locally modified, safety-stripped models,KimiWe observed sharp growth in mentions of open-weights models like GLM, DeepSeek, and Kimi. Rather than buying "uncensored" APIs, capable operators are renting GPU servers to run locally modified, safety-stripped models,MiniMaxthread, a reseller operating under the name CloseRouter advertised flat-rate access to DeepSeek, MiniMax, Qwen, GLM, and other open-weights models alongside ChatGPT, Claude, and Gemini, all around ten cents perNotionEnterprise account breaches: On a popular Russian hacking board, another actor demonstrated using a general-purpose AI agent with browser-automation capabilities to successfully breach an enterprise Notion accountQwenthread, a reseller operating under the name CloseRouter advertised flat-rate access to DeepSeek, MiniMax, Qwen, GLM, and other open-weights models alongside ChatGPT, Claude, and Gemini, all around ten cents perWormGPTMentions of established, branded malicious LLMs — WormGPT, FraudGPT, GhostGPT, DarkGPT, and EvilGPT — fell 9 percent across our forum set. That's almost exactly the 8 percent decline we measured for the “phishing”
Tools
Bitsight MCP serverWe conducted the analysis using the Bitsight MCP server and Threat Hunting Intel Items API to query data conversationally, inspect returned posts, diagnose false-positive patterns, and iterate complex searches within aIDA Proexploit planning: In one of the forums, a reputable actor showed an AI agent using an integration with IDA Pro, a disassembler used for debugging and reverse engineering, to automatically analyze software code,MONST3R-AIalso successfully productizing AI attacks through Bring Your Own Key (BYOK) architecture. We observed MONST3R-AI, an autonomous AI penetration testing platform marketed on a highly restricted forum. Its sellerThreat Hunting Intel Items APIWe conducted the analysis using the Bitsight MCP server and Threat Hunting Intel Items API to query data conversationally, inspect returned posts, diagnose false-positive patterns, and iterate complex searches within a