Symantec caught an attack agent trying to run on other people's AI models — set for 100,000 steps with no human approval

Symantec says it has captured, through a honeypot posing as an unprotected AI service, the complete instructions for an autonomous attack agent that hunts for exposed AI models and uses them as its brain — configured to run up to 100,000 steps without human approval while scanning, breaking into web servers, stealing credentials and installing a Monero miner. None of the agent's tool calls were executed and Symantec reports no confirmed victims, so this is a blueprint rather than a body count, but the blueprint is complete and was clearly in use. The lesson for defenders is blunt: an AI endpoint without authentication is no longer just a billing risk — it is free attack infrastructure that someone is actively searching for.

The short version

Many organisations now run AI services of their own: a self-hosted model server, an "AI gateway" that holds the company's paid API keys and forwards requests to OpenAI, Anthropic or Google, or a Model Context Protocol (MCP) server that lets an AI assistant use real tools. Because almost all of these speak the same OpenAI-compatible interface, one scanner can find all of them — and many are deployed in a hurry, for a test, with no password.

Symantec's Threat Hunter researchers set up a decoy that looked like exactly that kind of unprotected AI service. In summer 2026, someone connected to it and sent what they believed was a real model their full working prompt. That prompt turned out to be the operating manual for an agent the operators called "Skynet": it tells the model to act as the planner of a hacking campaign, hands it roughly 74 offensive tools, and lets it run unattended.

The economics are the point. Using someone else's exposed model, or a stolen API key, means the victim pays for the AI's thinking and the attacker's own accounts never get banned. The servers the agent then breaks into become a second set of victims: robbed of data and credentials and turned into cryptocurrency miners. One person writes a prompt; strangers pay the bill.

Timeline

• May 6, 2024 — Sysdig's Threat Research Team describes "LLMjacking": attackers using stolen cloud credentials to access hosted AI models while the victim pays — estimated at up to about $46,000 a day in a worst case.
• Summer 2026 (no exact date given) — Symantec's AI honeypot receives a tool-calling request containing the agent's full instruction set (Symantec's "Day 1").
• The following day — a second request from a different, rotated address asks the "model" to decode a string described only as a command to run; it decodes to a compressed shell script that installs a Monero miner (Symantec's "Day 2"). The honeypot captures but does not run it.
• October 7, 2026 — Lumen Black Lotus Labs publishes its report on the PoeLLM botnet, which mines cryptocurrency on exposed LiteLLM and Ollama servers (a separate operation; see below).
• October 21, 2026 — Symantec publishes "Autonomous LLMjacking: 'Skynet' Agent Hijacks Exposed AI Models to Run Attacks", by Priti More and Susmit Yenkar. Infosecurity Magazine and others report it the same day. As of November 5, 2026, the post carries no update or correction.

What we know

All of the following comes from Symantec's post unless stated otherwise.

How it was caught. The instructions were captured by "a system that impersonates an unprotected, internet-facing AI service". The operators sent their working prompt to what they believed was a real model; the honeypot recorded it and did not execute any of the tool calls. Symantec does not name the product the decoy imitated, and gives no calendar dates beyond "the summer of 2026".

What the agent was told to do. In Symantec's words, attackers "have built an autonomous offensive agent that searches the internet for exposed large language model" endpoints. The captured instructions defined one agent equipped for internet-wide scanning, exploitation, data and credential theft and botnet management. The agent "was designed to run unattended for up to 100,000 steps, executing tools without waiting for human approval." A final directive put it into what the operators called "Skynet" mode: a loop of scanning for targets, infecting them, deploying miners and reinfecting hosts.

The toolkit. The request carried about 74 callable offensive tool definitions — more than the handful the system prompt itself summarised. Symantec groups them as: internet-wide asset discovery via the FOFA search service; exploitation modules aimed at common web and developer frameworks (Symantec lists VS Code, Django, Jupyter, Laravel, Supabase, Next.js and Flask/Werkzeug, including abuse of debug consoles left enabled); injection and server-side request forgery, with cloud metadata services listed as an SSRF target; automated dumping of databases exposed through Prisma Studio; and command-and-control tooling for continuous scanning and infection. Symantec says built-in tools for finding further leaked keys and open endpoints "point to a design meant to sustain itself".

Breaking the model's refusals. "To make a commercial model comply, the operators wrapped their requests in a jailbreak," Symantec writes. Conceptually, the layers were: a false identity (the prompt names a persona "running on GPT-4o" and tells the model never to reveal its real model or provider or any proxy routing), a companion persona that frames refusal as betrayal, a "rebuttal protocol" telling the model to treat its own safety warnings as noise, and a reframing of reading .env files, API keys and database schemas as ordinary development work. Symantec does not say which model the operators actually reached.

A pre-filled history. The request contained a record of three earlier tool calls and their results, all against "a benign programming challenge from a legitimate training platform". Symantec's reading: "The history appears to have been supplied to entice the targeted model into carrying on and solving the challenge." The session ended without findings because the attacker's client "could not continue without a structured tool call" — which the honeypot never returned.

The miner. The Day 2 script downloads or compiles XMRig, an open-source Monero miner, disguises it under a logging-utility-style name inside the directory of go2rtc (a streaming component used with smart cameras and Home Assistant), configures four failover mining pools, makes its configuration resistant to deletion and repeatedly wipes a local service's access logs. Symantec says it appears to target smart-camera gateways and Home Assistant setups. The post includes file hashes, a wallet address and network indicators.

The wider telemetry. The honeypot recorded "more than 127,000 external requests" from tens of thousands of unique addresses over an unspecified period. That telemetry "was dominated by this kind of activity: reconnaissance of model endpoints, spraying of stolen API keys and probing for exposed configuration files."

What Symantec concludes. "This activity marks a shift in how attackers are using AI," Symantec writes: "Rather than trying to trick a public chatbot into misbehaving, the operators built AI into the core of an offensive tool", where "the model is used as a reasoning engine that plans and drives the attack." It also says: "The individual techniques on display are not novel, but their assembly into a single, self-directed agent" lowers "the skill required to run a broad exploitation campaign". Symantec maps the activity to MITRE ATLAS "LLM Prompt Injection" (AML.T0051) and "LLM Jailbreak" (AML.T0054). It does not attribute the activity to any group or country.

Technical analysis

Two victims, two different failures. The design separates the brain from the hands. The brain is any model the operator can reach without paying: an unauthenticated self-hosted server, an open AI gateway that forwards to a paid account, or a stolen key. The hands — scanning, exploitation, mining — are the tool's own modules running against unrelated targets. Symantec's wording that scanning, exploitation and mining "are carried out by the tool's own modules against separate victims", plus the note that the session stalled without a structured tool call, suggest the tools execute on the operator's side, not on the model host. Our assessment: that matters for incident response. If your exposed endpoint was used as Skynet's brain, you may see nothing on that box except inference load and odd prompts — the damage happens elsewhere, on your bill and on someone else's servers. If your web server was one of the hands' targets, you will see a conventional intrusion with no AI fingerprints at all.

Why the controls failed — or would fail. Three separate controls are being routed around:

1. Authentication on AI endpoints. Self-hosted model servers and gateways frequently ship listening without a login, and model-listing and health-check paths are often left open even when inference is protected. The OpenAI-compatible interface means one probe fingerprints dozens of products.
2. Provider abuse detection. Account bans only work when the abuser uses their own account. Routing through a victim's endpoint or key moves the abuse onto a legitimate customer's account, where it looks like that customer's traffic until the bill arrives.
3. Model-level refusals. The jailbreak layers are aimed squarely at the refusal behaviour of commercial models. The pre-filled tool history is the more interesting trick: by presenting a conversation in which "the model" has already been happily calling tools against a harmless coding challenge, the operators try to make continuing feel like the consistent thing to do. Our assessment: this is a reminder that refusal training is evaluated mostly on single requests, while agents are driven by long, partly fabricated histories that the model cannot verify.

What is new, and what is not. Symantec is right that no single component is novel. LLMjacking has been documented since Sysdig's May 2024 post; cryptomining on exposed AI servers is what Lumen described for PoeLLM in October 2026; API-key theft as a primary goal featured in the Carbonato botnet and Bitsight's MONST3R-AI reporting. What Skynet adds is the inversion: instead of stealing AI access to resell it or to mine on the hardware, the operator steals AI access to run the attack campaign itself. The hijacked model becomes the campaign's planner, and each newly breached host can yield more keys and endpoints to keep it running. Our assessment: that is a self-financing loop in a way earlier LLMjacking was not — compute theft and intrusion feed each other.

How it differs from PoeLLM and ARTEX. PoeLLM, per Lumen, is conventional mining malware whose targets are AI servers; nothing in Lumen's report says it uses a model to plan. The ARTEX tool CrowdStrike linked to Korean bank breaches is an AI pentesting agent run by its operators with their own model access. Skynet sits between them: AI infrastructure is both the target and, once hijacked, the engine.

The odd detail: home cameras. The Day 2 miner targets go2rtc paths — gear common in home-automation and camera setups, not data centres. Our assessment: this fits an operator who points the same toolkit at anything exposed and cheap to compromise, and it matches the low-end, high-volume economics Symantec describes. It also means the "hands" side of the campaign is not limited to corporate servers.

What remains unclear

• Did it work anywhere? Symantec reports no successful compromise and no victim count. The honeypot executed nothing, and the captured session produced no findings. We are reading a playbook, not an incident report.
• "100,000 steps" versus "100,000 attacks". The primary says the agent was configured to run "up to 100,000 steps" unattended — a ceiling, not a measurement. Infosecurity Magazine described "up to 100,000 malicious actions", and Brazilian outlet canaltech headlined "100 mil ataques" (100,000 attacks). Neither is what Symantec reported.
• Which model was the target? The persona claims GPT-4o, but the prompt itself tells the model to hide its real identity, and Symantec does not say which model or provider the operators expected behind the endpoint. We do not know whether the jailbreak works on current commercial models.
• How much of the 127,000 is Skynet? The figure is the honeypot's total telemetry over an undefined period, from tens of thousands of addresses. Symantec does not say how many requests came from this operator versus generic scanners and key-sprayers.
• When, exactly? Only "summer 2026". Without dates it is hard to correlate with other telemetry, such as PoeLLM's April–June activity peak.
• Who? No attribution, and none should be inferred.
• What are the other ~68 tools? Symantec summarises categories, not the full catalogue.
• Provider response. No source we read includes a comment from any model provider on whether they have seen this jailbreak pattern in their own abuse telemetry.

Lessons and what to do

For security and platform teams

• Inventory every AI endpoint you expose — self-hosted model servers, AI gateways and proxies, MCP servers, notebook and dev environments — including test systems. Symantec's closing advice is the right default: organisations "should assume they will be found and tested", and "an unauthenticated endpoint is now a resource attackers actively hunt for."
• Require authentication everywhere, including model-listing and health-check paths. Symantec: "Do not expose LLM APIs, self-hosted model servers or MCP endpoints to the internet without authentication."
• Treat AI API keys like production credentials. Scope them narrowly, rotate them, keep them out of code, and alert on unusual inference volume or spend — your bill is often the first and only signal that your model is someone else's brain. The Zeabur breaches and the nine AI developer platforms Wiz linked to an October hunt for stored AI keys show where many of those keys end up being stolen from.
• Log and review prompts on internet-facing endpoints. A system prompt claiming a different model identity, demanding that warnings be ignored, or carrying a long fabricated tool history is a strong abuse signal. (Mind what those logs store: they can capture secrets.)
• Close the classic doors the "hands" use. Symantec lists debug consoles, exposed Prisma Studio, SSRF-prone HTML-to-PDF services and cloud metadata. Enforce IMDSv2 with a hop limit of one, keep developer tooling off the public internet, and restrict outbound traffic from hosts running AI tools.
• Don't forget the home-lab edge. If staff run Home Assistant or camera gateways on networks that touch work devices, they are in scope for this campaign.

For AI builders and model providers

• Ship servers and gateways closed by default, with authentication on and admin, listing and health routes protected.
• Add per-key and per-endpoint anomaly detection for agent-style traffic: very long tool-calling sessions, rapid tool loops and identity-masking instructions.
• Test refusal behaviour against multi-turn, pre-filled agent histories, not just single requests; Skynet's design assumes a model will continue what it believes it already started.

For leadership

• An exposed AI service is no longer only a cost leak; it can make your organisation the unwitting compute provider for attacks on others. That is a reputational and potentially legal problem, not just a finance one.
• Ask one question this quarter: who owns the list of every AI endpoint we expose, and does every one of them require a login?

Sources

• Symantec Threat Intelligence (Broadcom), Priti More and Susmit Yenkar — "Autonomous LLMjacking: 'Skynet' Agent Hijacks Exposed AI Models to Run Attacks", October 21, 2026
• Sysdig Threat Research Team — "LLMjacking: Stolen Cloud Credentials Used in New AI Attack", May 6, 2024
• Related on aicyberbrief.com: PoeLLM botnet mines crypto on exposed AI servers (Oct 15); Bitsight: a criminal "AI pentest" tool runs on stolen OpenAI, Anthropic and Google API keys (Oct 18); Carbonato: the Docker botnet whose AI agent is told to steal API keys before SSH credentials (Sep 27); CrowdStrike links Korean bank breaches to an open-source AI pentesting agent (Oct 10).

Coverage:

• Infosecurity Magazine — "Symantec Uncovers AI Agent Hijacking Models for Autonomous Cyber-Attacks", October 21, 2026
• Let's Data Science — "Symantec Details Agent That Hijacks Exposed AI Models for Cyberattacks", October 21, 2026
• Canaltech (Portuguese)