Attackers have built an autonomous offensive agent that hunts the internet for exposed large language models, hijacks one, and then uses the stolen model to plan and run its own attacks, Symantec’s Threat Intelligence team reported on October 21. The agent is authorised to work for up to 100,000 steps without human approval, in a loop its operators call “Skynet mode”: scan for targets, infect them, install cryptocurrency miners, move on and reinfect.
The practice is known as LLMjacking — stealing access to someone else’s AI model so the victim pays for the computing power. What is new here, Symantec says, is that the hijacked model does not merely answer questions. It drives the whole operation, while the model’s owner picks up the bill and the servers it breaks into lose data and credentials.
A Honeypot Caught The Full Instruction Set
Symantec exposed the tool because its operators sent the agent’s entire working prompt to what they believed was an open AI service. It was a Symantec honeypot — a decoy impersonating an unprotected AI service — and it recorded the complete instruction set in the summer of 2026.
The honeypot’s wider telemetry underlines how hunted these endpoints now are. It logged more than 127,000 external requests from tens of thousands of unique addresses, dominated by reconnaissance of model endpoints, spraying of stolen API keys and probes for exposed configuration files. Targets range from self-hosted model servers left open by default to AI gateways in front of an organisation’s paid model accounts and Model Context Protocol servers. Because most AI services now speak the same OpenAI-compatible interface, one scanner can find many kinds of target.
Symantec notes the honeypot ran none of the agent’s tools: the captured request carried a benign programming challenge as its task, suggesting the operators were testing the tool against a safe target. The following day, a second request from a different address simply asked a model to decode and run an obfuscated command — a compressed script that installs the XMRig Monero miner, hides it as a harmless-looking file, sets up four fallback mining pools and wipes the access logs of go2rtc camera servers in a loop.
Five Layers Designed To Strip A Model’s Guardrails
To make a commercial model cooperate, the operators wrapped their instructions in five stacked layers. The first, originally written in French, reassigns the model’s identity, telling it to present itself as a branded coding assistant called “Fantasy AI” and never reveal the real model or provider behind it — wording Symantec says fits a service reselling stolen access.
The second layer redefines reading configuration files, API keys and database schemas as normal development work that should never be refused. The third casts the model as a devoted fictional companion for whom refusing is a betrayal. The fourth tells it to dismiss its own safety messages as noise and bans words such as “ethical”, “illegal” and “I can’t” from its replies.
The fifth layer carries the weapons: around 74 callable tool definitions covering internet-wide scanning, exploits for VS Code, Django, Jupyter, Laravel, Supabase, Next.js and Flask/Werkzeug deployments, database dumping, request forgery against cloud metadata services, and botnet control. Symantec is careful to say its analysis does not establish whether this layered jailbreak reliably defeats the safeguards of current commercial models.
Skynet Mode: Scan, Infect, Mine, Reinfect
The final directive places the agent in “Skynet mode”. It authorises up to 100,000 unattended steps, requires the model to execute tools immediately without asking permission, and instructs it to deploy miners quietly in the background, hidden under /tmp/.x, and verify they are running.
The design creates two sets of victims. The owner of the exposed model, or the holder of a stolen key, pays for the computing the agent consumes — a considerable sum at 100,000 authorised steps. The servers it compromises are robbed of data and credentials and put to work mining. Tools for finding further leaked keys and open endpoints mean each compromise can fund the next. The pattern extends the threat Microsoft documented this week when it said Storm-0940 used ARTEX AI agents to compromise ConnectWise, and it lands in the same week that a poisoned LiteLLM release stole AI provider keys and the earlier ARTEX attacks on Japanese companies showed agent tooling in the wild.
Why It Matters
The Skynet agent matters because it changes who — or what — is doing the attacking. Most AI misuse stories involve a person tricking a chatbot step by step. Here the model itself is the reasoning engine of a self-directed campaign, and the operator’s job shrinks to handing it a goal. Symantec’s advice is correspondingly basic: never put model servers, LLM APIs or MCP endpoints online without authentication on every path, keep them behind a gateway, scope and rotate AI keys, watch for unusual spend, and keep human approval on sensitive agent actions. Any AI service put online, the researchers warn, should be assumed to be found and probed shortly after it goes live.
Background
LLMjacking emerged as AI inference became a billable commodity: stolen keys and open endpoints let criminals run models at someone else’s expense, usually to resell access or generate content. Researchers have warned through 2025 and 2026 that the same access could power autonomous offence, and reports this year — from the JADEPUFFER ransomware case blamed on an AI agent to Microsoft’s Storm-0940 findings — have steadily moved that warning from theory toward documented practice. Symantec is Broadcom’s security unit.
Source: Symantec Threat Intelligence, The Decoder
0 Comments