MONST3R-AI advertised autonomous penetration testing but verified exploitation was absent

Bitsight observed an underground advertisement promoting MONST3R-AI with bring-your-own-model-key integration, target configuration and a dashboard claiming more than one thousand findings across 199 hosts. The marketing is evidence that such a service was advertised; it does not demonstrate that each listed host existed, that the detections were valid or that subscribers successfully compromised anyone.

The proposed workflow creates two independent risk questions. A model-provider API key may pay inference charges, but possessing that key does not authorize the user to attack a network destination. Separately, a malicious service accepting the key could misuse it, although Bitsight's discussion does not prove a specific instance of key theft. Both risks are hypotheses requiring logs or an inspectable implementation.

Underground forum counts are indicators of interest, not incident counts. The wider Bitsight sample covered sixteen forums with selection and migration biases. A convincing follow-up would preserve the original seller listing, inspect a safe demo against owned systems and reconcile claimed findings with independently reproducible vulnerabilities before describing the platform as operational offensive automation.