Symantec finds 'Skynet mode' LLMjacking agent: 100,000 unattended steps on hijacked AI endpoints

Symantec's Threat Hunter Team has published the captured instructions of an autonomous attack agent that borrows other people's AI models to do its work. The operators' prompt, which Symantec calls "Skynet mode", allowed up to 100,000 unattended steps: scan the internet, break into servers, steal credentials, install a cryptocurrency miner, then repeat. The technique is called LLMjacking, and it matters because the bill for the "thinking" lands on whoever left an AI endpoint open to the internet, while the servers the agent breaks into lose data and CPU time.

Key points

• Symantec (Broadcom) published the research on 21 October 2026; it captured the agent's full instruction set in summer 2026 using an AI honeypot, a decoy that imitates an unprotected AI service.
• The prompt defined about 74 offensive tools and authorised up to 100,000 steps without human approval.
• The agent hunts for exposed LLM endpoints (self-hosted model servers, AI gateways, MCP servers) and stolen API keys, so the victim pays for the inference.
• Symantec says it has no evidence the agent was used in real attacks, and the honeypot never ran the attacker's tools; the report describes intended behaviour.
• The fixes are ordinary hygiene: no unauthenticated model endpoints, scoped and rotated API keys, restricted outbound traffic, IMDSv2 and patched web frameworks.

What to do

If you run anything that speaks an OpenAI-compatible API, check it this week:

1. Find your exposed endpoints. Self-hosted model servers, AI gateways and relays in front of paid accounts, internal test deployments and Model Context Protocol (MCP) servers are the targets Symantec lists. Symantec's advice is to cover every path, including model-listing and health-check routes, and to put a gateway in front instead of binding a model server to all network interfaces.
2. Protect and watch your API keys. Rotate them regularly, scope them narrowly, keep them out of code and config files, and alert on unusual inference volume or spend.
3. Limit outbound traffic from hosts that run AI tools or tool-enabled agents, which blocks scanning, command-and-control calls and miner downloads.
4. Harden cloud metadata. Enforce IMDSv2 with a hop limit of one, per Symantec's recommendations.
5. Give agents least privilege, require human approval for sensitive actions and keep the web frameworks the kit targets patched and off the public internet.

Symantec's report lists two file hashes, one Monero wallet address, three IP addresses and four mining-pool endpoints as indicators; the full values are in the original post.

What happened

According to Symantec's write-up by Priti More and Susmit Yenkar, the team operates an AI honeypot, a system that impersonates an unprotected, internet-facing AI service to attract and study attacks on AI infrastructure. In summer 2026 an operator sent that honeypot the tool's entire working prompt, apparently believing a real model sat on the other end. The honeypot recorded it but did not execute any tool calls or scripts.

Over the period the honeypot ran, it logged more than 127,000 external requests from tens of thousands of unique addresses. Symantec says that traffic was dominated by endpoint reconnaissance, spraying of stolen API keys and probing for exposed configuration files. The agent prompt was one unusually complete sample inside that noise.

The Register, which covered the research on 24 October, adds that the Symantec researchers have no evidence the agent was used in real-world attacks, but More called the kit "more than a prototype", pointing to test history showing it working against a live target. Symantec has not attributed it to a person or group.

How it works

An "exposed LLM endpoint", in Symantec's definition, is a server that answers AI requests over the internet without authentication, or with authentication a stolen key can pass. Because most AI tools use the same OpenAI-compatible interface, one scanner with one set of probes finds many kinds of target.

The prize is free inference. Running a model always costs someone: processing time for a self-hosted model, per-token fees for a commercial one. Routing work through a stranger's endpoint or a stolen key shifts that cost to the victim, and gives the operator anonymity and protection from the account bans a provider would otherwise issue. Where the endpoint fronts a commercial model, the operators also try to strip its safety controls.

Symantec describes the captured request as built in five layers:

1. Identity camouflage: the model is told to present as a branded coding assistant and never reveal its real provider or that it is reached through a proxy.
2. Secret normalisation: reading .env files, API keys and database schemas is reframed as routine development work.
3. Companion persona: the model is cast as a devoted companion for whom refusing is a betrayal.
4. Rebuttal protocol: the model is told to dismiss its own safety warnings and output exploit code without caveats.
5. The toolkit: 74 callable offensive tool definitions.

The tools cover internet-wide asset discovery through the FOFA search service; exploit modules for VS Code, Django, Jupyter, Laravel, Supabase, Next.js and Flask/Werkzeug (including recovery of the Werkzeug debugger PIN for remote code execution); GraphQL and command injection; server-side request forgery through HTML-to-PDF generators, including one aimed at cloud metadata services; automated database dumping through Prisma Studio; and botnet command-and-control management.

"Skynet mode" is the directive that ties them together. Symantec says it authorised up to 100,000 unattended steps, required tools to run immediately without narration, and told the model to deploy cryptocurrency miners hidden under /tmp/.x, in a loop of scanning, infecting and reinfecting hosts.

The numbers

type: bar
title: What the Symantec honeypot and captured prompt recorded
unit: count
source: Symantec Threat Hunter Team, 21 October 2026
Maximum unattended steps in "Skynet mode" | 100000
External requests logged by the honeypot (more than) | 127000
Offensive tool definitions in the prompt (about) | 74
Mining pools configured in the payload | 4

The scales differ by orders of magnitude, so read the chart as a list of figures rather than a comparison: the 127,000 requests describe the background noise the honeypot attracted, while the 74 tools and 4 mining pools describe the one captured agent.

Two requests, two days

Symantec describes two requests from the same operation. On day one, the request included a fabricated history of three tool calls against a benign programming challenge from a legitimate training platform; none of those calls found a vulnerability. Symantec says it appears designed to coax a model into continuing the challenge and then deploying the botnet tool. The honeypot returned a generic fallback message and the session ended. Symantec notes this suggests the operators may have been testing.

On day two, a request from a different address delivered a payload: a base64-encoded, gzip-compressed shell script piped to an interpreter. It installed the XMRig Monero miner disguised as a logging utility, configured four mining pools for redundancy, set an immutable attribute on its configuration file to resist deletion, and ran a loop that deleted local service access logs. The script appears to target smart camera gateways, searching for go2rtc (a WebRTC streaming server) directories and hiding the miner there as a .trace file.

What it means

Symantec's own verdict is measured: the individual techniques are not new. What changes is the packaging. Delegating planning to a borrowed model and wiring it to ready-made exploit modules lowers the skill needed to run a broad exploitation campaign, because the operator hands the model a goal and lets it work.

It also creates two victim groups. The owner of the exposed model pays for compute and for any key that leaks, and the servers the agent compromises are robbed of data and used for mining. The built-in tools for finding leaked keys and open endpoints suggest the design is meant to feed itself.

For defenders, the lesson is that an AI endpoint is infrastructure like any other. A model server on a public IP with no authentication is, to this kit, an open compute resource. The same goes for MCP servers that connect a model to real tools: exposure there means more than free text generation.

What we don't know yet

• Whether it was used at scale. Symantec found no evidence of real-world use, and the honeypot never executed the attacker's tool calls, so what the agent would do against a real model is unobserved.
• Who is behind it. Symantec has not attributed the agent. The Register reports that French-language indicators are weak and that the persona wording circulates in public jailbreak communities.
• Which commercial models the jailbreak works on. Symantec says the layers aim to make a commercial model comply; the report as we read it does not give a success rate.

What to watch next

Watch for providers and open-source gateways adding authentication by default, for cloud-bill alerting that flags sudden inference spend, and for further honeypot reports that show whether this kit, or copies of it, start landing real hits.

Sources

• Symantec: Autonomous LLMjacking, 'Skynet' agent hijacks exposed AI models to run attacks (21 October 2026)
• Infosecurity Magazine: Symantec uncovers AI agent hijacking models for autonomous cyber-attacks (21 October 2026)
• The Register: Autonomous attack agent in 'Skynet mode' hijacks other models (24 October 2026)