Honeypot captures agent that hijacks exposed AI models
Original title: Hackers hijack exposed AI models to launch cyberattacks at victims’ expense
The captured prompt tells a stolen model to scan, exploit web apps, steal secrets and mine, for up to 100,000 steps.
Symantec researchers Priti More and Susmit Yenkar say a honeypot posing as an unprotected AI service received an agent prompt this summer. Once connected, the agent is told to scan targets, exploit common web frameworks, steal databases and credentials, and install cryptocurrency miners without human approval. A later request decoded to a shell script that downloads XMRig and looks for go2rtc directories used by camera servers. The honeypot did not run the script.
Unconfirmed: Symantec observed the prompt and script on a honeypot; successful compromises of real victims are not confirmed.
- The honeypot logged more than 127,000 external requests from tens of thousands of addresses.
- Targets include open model servers, AI gateways, test systems and MCP servers.
- A jailbreak sought .env files, API keys and database schemas and banned refusal language.
- The prompt carried about 74 tool definitions, including Django, Jupyter and Laravel exploits.
- The miner script hides XMRig as a file named .trace in the first go2rtc directory found.
Impact: Stolen compute, credentials and databases, plus miner installation
| Product | Affected |
|---|---|
| exposed AI model servers, gateways and MCP servers | — |
- 1.Do not leave model, gateway or MCP endpoints unauthenticated on the internet.
- 2.Protect API keys and check for exposed configuration and .env files.
- 3.Watch camera and go2rtc hosts for a hidden .trace XMRig miner.
From the original article
3 min read at helpnetsecurity.com
An attack tool built around AI goes looking for AI models that anyone on the internet can reach, then uses them to plan break-ins while the model’s owner pays for the computing power. Symantec captured the agent’s instruction set this summer through a honeypot posing as an unprotected AI service, researchers Priti More and Susmit Yenkar wrote.
By Sinisa Markovic · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.