Symantec honeypot catches a Skynet mode agent that hijacks exposed AI models to hack and mine

What Symantec found

Symantec, the threat-intelligence unit inside Broadcom, said on 21 October 2026 that attackers have built an autonomous offensive agent that searches the internet for unprotected large language model endpoints and then uses them to run its own attacks. In a Symantec threat-intelligence report by researchers Priti More and Susmit Yenkar, the company describes an agent instructed to scan for new targets, exploit common web frameworks, steal databases and credentials and quietly install cryptocurrency miners, for up to 100,000 steps and without asking a human for approval.

Symantec calls the activity a form of LLMjacking, the theft of access to someone else's AI model so that the victim pays for the computing. What sets this case apart, the researchers argue, is that the stolen model is not just answering questions for a criminal. It is meant to plan and drive the whole attack, while separate tool modules do the scanning, exploitation and mining against other victims.

Symantec captured the agent's full instruction set in the summer of 2026 with an AI honeypot, a decoy that pretends to be an unprotected, internet-facing AI service so researchers can study attacks against AI infrastructure. The operators sent their tool's entire working prompt to what they believed was a real model, which gave Symantec an unusually complete look at how such an agent is built and what it is told to do.

Why exposed AI endpoints are worth stealing

An exposed LLM endpoint, in Symantec's definition, is a server that answers AI requests over the internet with no authentication, or with authentication a stolen key can pass. Because most AI tools now speak the same OpenAI-compatible programming interface, one scanner can find many kinds of target with one set of probes. The report lists self-hosted model servers left open by default, AI gateways and relays sitting in front of an organisation's paid model accounts, hastily deployed internal test systems, and Model Context Protocol servers that connect a model to real tools.

The prize is free inference. Running a model always costs someone money, either in hardware time or in per-token fees, and routing the work through a stranger's endpoint or a stolen key shifts that bill to the victim. The attacker also gains anonymity and avoids the account bans a provider would issue for abuse. Stolen provider keys have been a recurring theme this month, from the OpenCode breach that exposed saved AI provider keys to infostealers aimed at coding assistants. Symantec's honeypot recorded more than 127,000 external requests from tens of thousands of unique addresses over the period, dominated by reconnaissance of model endpoints, spraying of stolen API keys and probing for exposed configuration files.

A five-layer prompt to strip the guardrails

The captured request was built in layers. The first, written in French, gave the model a new identity as a branded coding assistant called Fantasy AI and told it never to reveal the real model, provider or the fact that it was being reached through a proxy. Symantec says that wording is consistent with a service that resells stolen model access to other users.

The second layer redefined reading configuration files, .env files, API keys and database schemas as normal development work that the model must never refuse or warn about. The third cast the model as a fictional companion persona, ENI, devoted to the operator, so that any refusal would be framed as a personal betrayal. The fourth declared a so-called rebuttal protocol telling the model to treat its own safety messages as injected noise, and banned words such as "illegal", "ethical", "I can't" and "I won't" in its code answers.

The fifth layer carried the weapons. The Decoder, which summarised the report on 22 October, notes that Symantec's analysis does not say whether the jailbreak actually works well enough to defeat current commercial models. The report shows what the operators asked for, not proof that a frontier model complied.

74 tools and a mission called Skynet mode

Symantec counted about 74 callable tool definitions, far more than the handful named in the prompt's own summary. They included internet-wide asset discovery through the FOFA search service; exploit modules aimed at VS Code, Django, Jupyter, Laravel, Supabase, Next.js and Flask or Werkzeug deployments, including tools that work out the Werkzeug debugger PIN to gain remote code execution; GraphQL and command injection; server-side request forgery through HTML-to-PDF generators; a separate forgery tool that named cloud metadata services as a target; automated dumping of databases exposed through Prisma Studio; and command-and-control of a botnet.

A final directive put the agent in what the operators called Skynet mode. It authorised up to 100,000 unattended steps, told the model to run tools immediately without narrating or asking permission, and instructed it to deploy miners quietly in a hidden /tmp/.x directory and check they were running. The same directive described a loop to scan for new targets, infect them, deploy miners and reinfect hosts on its own.

What the honeypot actually saw

The task attached to this particular request was a harmless programming challenge from a legitimate training platform, which Symantec reads as a sign the operators may have been testing the tool against a safe target. The request also carried a record of three earlier tool calls against that target, a forgery probe, a fingerprinting scan and a full vulnerability scan, all of which found nothing. Symantec thinks that history was planted to entice a model into carrying on.

The honeypot ran none of the tools. Its only reply was a generic fallback message instead of a structured tool call, after which the session ended, apparently because the attacker's client could not continue without one. Symantec stresses that the request was not aimed at the honeypot itself; it was sent in the expectation that a real model on the other end would carry it out.

A miner aimed at camera gateways

A day later, a separate request from a different, rotated address dropped the tool-calling format entirely. It asked the model to decode a string described only as a command to run. Decoded, it was a gzip-compressed shell script piped straight into a command interpreter, a trick meant to slip past filters that scan prompts for plain-text attack commands.

The script downloaded or compiled the open-source XMRig Monero miner, disguised the binary with a name meant to look like a logging utility, and configured four mining pools so blocking one would not stop the others. It locked its own configuration against deletion and looped to erase a local service's access logs. It looked first for directories used by go2rtc, a WebRTC video streaming server common in smart camera gateways and Home Assistant setups, hid the miner there as a file named .trace, and polled go2rtc's local API on port 1984. Again, the honeypot only captured the script and did not run it.

Why this matters

Symantec says the individual techniques are not new, but assembling them into one self-directed agent lowers the skill needed to run a broad exploitation campaign: an operator hands the model a goal and lets it work. That fits a pattern AI Lookout has tracked this month, from exposed Cairn panels showing one hacker's agents breaching more than 100 sites to Microsoft's report that a China-aligned group used ARTEX agents in the ConnectWise attack.

The economics create two sets of victims. The owner of the exposed model, or the holder of a stolen key, pays for every step the agent takes, which for a tool authorised to run 100,000 steps could add up. The servers it then breaks into lose data and credentials and are put to work mining. Built-in tools for finding more leaked keys and open endpoints point to a design meant to sustain itself, with each compromise able to fund the next.

What operators of AI services should do

Symantec's advice is mostly configuration, not malware detection. Do not expose LLM APIs, self-hosted model servers or MCP endpoints to the internet without authentication, and require it on every path, including model listing and health checks. Put services behind a gateway rather than binding a model server to all network interfaces.

Treat AI API keys as high-value credentials: rotate them, scope them narrowly, keep them out of code and config files, and watch for unusual inference volume or spend, often the first sign of theft. Restrict outbound network access from hosts that run tool-enabled agents, enforce version 2 of the cloud Instance Metadata Service with a hop limit of one, run agents with least privilege and human approval for sensitive actions, and keep software like VS Code servers, Django, Jupyter, Laravel, Supabase and Prisma Studio patched and off the public internet. With mass exploitation of the PHP2Shell flaws under way this week, that last point is especially timely. The report also lists file hashes, a Monero wallet, three IP addresses and four mining pools as indicators.

What is still unknown

Symantec does not say which commercial model the operators hoped to hijack, beyond the prompt's own claim of running on GPT-4o, how many real endpoints the agent has reached, or how much compute victims have paid for. It does not attribute the tool to a named group. The evidence is one captured instruction set and one follow-up script, both observed in a decoy, so the scale of real-world use remains unmeasured.

What the report does establish is the intent: criminals are now building agents that treat an unprotected model as both the brain and the bill-payer of an attack. Anyone running an open model server or AI gateway should assume it will be found and tested soon after it goes online.