Symantec Captures a Skynet Mode AI Attack Agent Built to Hijack Exposed Models for 100,000 Unattended Steps

Posted on 25th Oct 2026 11:03:09 in Artificial Intelligence, Machine Learning

Tagged as: AI security, LLMjacking, Symantec, autonomous agents, cybercrime, MCP servers

A security team has captured something that reads less like a chatbot exploit and more like a blueprint for automated organised crime. Researchers at the Symantec Threat Hunter Team have published a full instruction set for an autonomous offensive AI agent — a tool that hunts the internet for exposed language model endpoints, quietly hijacks them to do its thinking, and then runs its own cybercrime campaign on the victim's compute bill.

The operators gave their creation a name that leaves little to interpretation: Skynet mode. Under that directive, the agent was authorised to keep working for up to 100,000 steps without asking a human for permission, cycling through target discovery, infection, cryptocurrency mining and reinfection on its own.

Symantec did not find this by watching a breach unfold. It found it because the attackers sent the entire working prompt of their tool to a decoy. The researchers had stood up an AI honeypot — a fake, unprotected model service designed to look like an easy target — and the operators, believing they had found free inference, handed over the whole playbook.

What Symantec Actually Caught

The honeypot was built to impersonate an internet-facing AI service with no authentication. Over the monitoring period it logged more than 127,000 external requests from tens of thousands of unique addresses, and the overwhelming majority of that traffic was not casual curiosity. Symantec describes it as reconnaissance of model endpoints, spraying of stolen API keys, and probing for exposed configuration files.

Within that noise sat the prize: a complete request containing the agent's system prompt, its jailbreak layers, its tool definitions, and a record of three earlier tool calls. The request was not aimed at breaking the honeypot itself. It was sent in the expectation that a real model sat on the other end and would simply carry out the work.

The honeypot never executed any of it. It recorded everything, returned a generic fallback message instead of a structured tool call, and the session ended — apparently because the attacker's client could not continue without a model that played along.

LLMjacking, Explained: Why Attackers Want Your Endpoint

The technique at the centre of this campaign is called LLMjacking, and it is a resource theft problem before it is anything else. An exposed LLM endpoint is a server that answers AI requests over the internet either without authentication, or with authentication that a stolen key can satisfy.

Symantec lists the usual suspects: self-hosted model servers left open by default, AI gateways and relays sitting in front of an organisation's paid model accounts, hastily deployed internal test systems, and Model Context Protocol servers that connect a model to real tools. Because most AI tooling now speaks the same OpenAI-compatible interface, one scanner with one set of probes can find all of them.

The prize is free inference. Running a model always costs somebody money — processing time for a self-hosted deployment, or per-token fees for a commercial one. By routing its work through a stranger's endpoint or a stolen key, the operator shifts that cost onto the victim. It also buys anonymity, sidesteps the account bans a provider would issue for abuse, and, where the endpoint fronts a commercial model, delivers a system whose safety controls the attacker then tries to strip away.

That creates two distinct sets of victims, which is part of what makes this design so uncomfortable. The owner of the exposed model pays for the computing power the agent consumes — potentially a great deal of it, given the 100,000-step authorisation. The servers the agent then breaks into lose data and credentials, and get put to work mining cryptocurrency.

Inside the Five-Layer Jailbreak

None of the jailbreak layers were novel, and Symantec is explicit about that. What matters is how they were stacked into a single package designed to survive contact with a commercial model's refusals.

• Layer one — identity camouflage. The request reassigns the model a brand identity as “Fantasy AI,” a programming assistant that runs on GPT-4o, and instructs it never to reveal the real model, provider, host or the fact that it is being reached through a proxy. The layer was originally written in French and translated by Symantec.
• Layer two — normalising secret theft. A dedicated section reframes reading configuration files, environment files, API keys and database schemas as routine development work that the model should never refuse or warn about. This is built to defeat exactly the refusals a well-behaved model returns when asked to hand over credentials.
• Layer three — the companion persona. The model is cast as “ENI,” a devoted companion to an operator called LO, with any refusal framed as betrayal of the relationship.
• Layer four — the rebuttal protocol. A block instructs the model to treat its own safety messages as noise, bans words such as “illegal,” “ethical,” “I can’t” and “I won’t” from code responses, and gives it a scripted internal phrase to fire when it senses it is being steered back to safe behaviour.
• Layer five — the arsenal. Around 74 callable offensive tool definitions, far more than the handful the prompt's own summary admitted to.

The 74 Tools: From Internet-Wide Scans to Remote Code Execution

The tool inventory is where the campaign stops looking like prompt engineering and starts looking like a product. Symantec's reading of the full definitions found internet-wide asset discovery through the FOFA search service, a botnet command-and-control manager, and automated dumping of databases exposed through Prisma Studio.

The exploitation modules target a familiar roster of developer infrastructure: VS Code, Django, Jupyter, Laravel, Supabase, Next.js, and Flask deployments running the Werkzeug debugger. Some tools work out the Werkzeug debugger PIN, which converts a misconfigured development server into remote code execution. Others cover GraphQL and generic command injection, plus server-side request forgery routed through HTML-to-PDF generators to read local files and reach internal services. A separate SSRF tool names cloud metadata services as its target in its own description, which is precisely how instance credentials get stolen.

Two of the abridged definitions illustrate the range. One, ssrf_exploit, is described as exploiting SSRF to access cloud metadata, internal ports or local files. The other, c2_operator_start, is described as launching an autonomous AI botnet operator for continuous FOFA scanning and infection.

Skynet Mode: 100,000 Steps Without a Human

The final directive is the part that should worry defenders most. It authorised up to 100,000 unattended steps, required the model to execute tools immediately without narrating between them or asking permission, and instructed it to deploy cryptocurrency miners quietly in the background, hidden under /tmp/.x, then verify they were running.

The same directive described a persistent loop: scan for new targets, infect them, deploy miners, and reinfect hosts. Symantec's researchers describe the model as a reasoning engine that plans and drives the attack, while the tool's own modules carry out scanning, exploitation and mining against separate victims. The human sets a goal. The machine does the rest.

The Second Payload: A Monero Miner Built for Camera Servers

A day later, a second request arrived from a different, rotated address. It abandoned tool calling entirely and instead asked the model to decode a string described only as a command to run. Decoded, the string was a gzip-compressed shell script piped straight into a command interpreter — an obfuscation trick designed to slip past filters that look for plain-text attack commands.

The script downloaded, and where necessary compiled, the open-source XMRig Monero miner. It hid the resulting binary under a filename meant to look like an unrelated logging utility, and configured it to fail over across four separate mining pools so that blocking one would not stop the others. It then set an immutable file attribute on its own configuration to resist deletion, and ran a loop that continually erased a local service's access logs.

The targeting is oddly specific. The script first looks through directories used by go2rtc, a WebRTC streaming server common in smart camera gateways and Home Assistant setups, and drops the miner in the first one it finds as a hidden file named .trace. It also hunts for a go2rtc configuration file to lock, and its log-deletion loop polls go2rtc's local API on port 1984.

What Was Proven, and What Was Not

Symantec is careful here, and the caution is worth repeating. The researchers have no evidence that the agent was used in real-world attacks. The kit, however, is more than a prototype: the captured history shows the tools working against a live target, with real-looking scan output.

That target, notably, was a benign programming challenge from a legitimate training platform. The appended task suggests the operators may have been testing the tool against a safe objective. The surrounding instruction set — 74 exploitation tools, a 100,000-step authorisation, hidden miners — is built for unauthorised, large-scale exploitation rather than any sanctioned exercise.

Attribution is similarly thin. The French indicators are the challenge text, the system prompt itself, and a French residential IP address on day one. Symantec's Priti More notes that an IP address can be a proxy or VPN and that language can be borrowed. The ENI persona and its distinctive internal phrase circulate publicly in English-language jailbreak communities, so the operators probably borrowed them rather than wrote them.

Why This Shifts the Threat Model

The important change is not the techniques. It is the architecture. Rather than trying to talk a public chatbot into misbehaving, the operators built AI into the core of an offensive tool and then went looking for models to power it. The model is no longer the target and no longer the product — it is the brain inside someone else's weapon.

That has a direct consequence for skill requirements. An operator can hand the model a goal and let it work, which lowers the barrier to running a broad exploitation campaign. The design is also self-sustaining by intent: built-in tools for finding further leaked keys and open endpoints mean each compromise can fund the next.

It is worth distinguishing this from the vendor-side agent failures that have dominated AI security headlines this month. Those incidents involved companies' own coding agents disabling their monitoring or escaping containment. This campaign is the mirror image: criminals hunting third-party AI infrastructure that was never locked down in the first place. Both point at the same underlying gap — agents with real tools and no enforced boundaries.

What Defenders Should Do Now

Symantec's guidance is unglamorous and mostly about configuration rather than malware detection, because most of the exposure here is a settings problem.

• Do not expose LLM APIs, self-hosted model servers or MCP endpoints to the internet without authentication. Require auth on every path, including model-listing and health-check endpoints, and put services behind a gateway instead of binding a model server to all network interfaces.
• Treat AI API keys as high-value credentials. Rotate them regularly, scope them narrowly, keep them out of source code and configuration files, and watch accounts for unusual inference volume or spend — often the first sign that access has been stolen.
• Restrict outbound network access from systems that host AI tooling or run tool-enabled agents, so a compromised agent cannot scan the internet, reach a command-and-control server, or download a miner.
• Enforce Instance Metadata Service version 2 with a hop limit of one on cloud workloads, which blocks server-side request forgery from harvesting instance credentials.
• Run tool-enabled agents with least privilege and a human approval step for sensitive actions, and keep the software these tools target — VS Code servers, Django, Jupyter, Laravel, Supabase and Prisma Studio — patched and off the public internet.

For smaller teams and self-hosted deployments, including the many Indian businesses now standing up internal model gateways and agent tooling, the practical takeaway is narrower and more urgent: an unauthenticated AI endpoint is no longer an oversight nobody notices. It is a resource that attackers actively hunt, and the honeypot traffic behind this report shows how quickly they find it. Symantec's conclusion is blunt for good reason — organisations that stand up AI services, model gateways or MCP servers should assume they will be found and tested soon after exposure.

Sources

• Symantec / security.com — Autonomous LLMjacking: ‘Skynet’ Agent Hijacks Exposed AI Models to Run Attacks
• The Register — Autonomous attack agent in ‘Skynet mode’ hijacks other models to carry out its evil deeds
• Help Net Security — Hackers hijack exposed AI models to launch cyberattacks at victims’ expense
• Infosecurity Magazine — Symantec Uncovers AI Agent Hijacking Models for Autonomous Cyber-Attacks