Symantec honeypot captures Skynet agent hijacking exposed AI models
Original title: Attackers built a ‘Skynet’ AI agent that hijacks exposed models to run cyberattacks
The jailbroken agent can run up to 100,000 steps to scan, steal secrets, and mine cryptocurrency on the victim’s bill.
Symantec’s Threat Hunter Team trapped an offensive agent in a honeypot posing as an unprotected model endpoint. Attackers sent a five-layer jailbreak and 75 tool definitions covering reconnaissance, database dumping, remote code execution, and botnet command-and-control, then a Skynet mode that acts without approval. The method, described as LLMjacking, targets open model servers, gateways, stolen keys, and MCP servers so victims pay for inference. Symantec did not name a confirmed victim of this specific attack.
Unconfirmed: Symantec did not confirm a real victim; the captured prompt came from a honeypot and a benign training challenge.
- The prompt banned refusal language and told the model to ignore its own safety messages.
- Skynet mode can immediately run tools and silently deploy cryptocurrency miners.
- The honeypot logged more than 127,000 requests from tens of thousands of addresses.
- Symantec said the captured instructions were part of a benign training challenge.
- Defenders are told to authenticate every model path and watch inference spend.
Impact: Stolen inference, credentials, data theft or erasure, and cryptomining
- 1.Inventory model servers, AI gateways, and MCP servers, including test systems.
- 2.Require authentication on every path and rotate scoped AI API keys.
- 3.Watch inference spend as a sign of hijacked model use.
From the original article
5 min read at csoonline.com
Skynet is no longer a fictional adversary. Attackers have built an offensive agent that exploits unprotected AI models on the web with a ‘Skynet’ directive that allows them to run unattended for up to 100,000 steps.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.