Symantec finds AI agent hijacking exposed models for autonomous attacks
Original title: An AI agent in "Skynet mode" hijacks unprotected language models to launch self-sustaining cyberattacks
A honeypot captured a five-layer jailbreak and a loop of up to 100,000 steps that scans, steals data, and installs XMRig.
Symantec says an offensive agent hijacks unprotected language models and then plans attacks for up to 100,000 steps without a human. The model owner pays the compute bill, while targeted servers can lose databases and credentials and host cryptominers. A summer 2026 honeypot received the full prompt, including 74 modules, but did not run the tools. A later session carried an obfuscated script that downloads XMRig for go2rtc camera servers.
Unconfirmed: Symantec does not say whether the jailbreak defeats current commercial models, and the honeypot never executed the tools.
- Honeypot telemetry logged more than 127,000 requests from tens of thousands of addresses.
- Attackers brute-forced stolen API keys and probed exposed configuration files.
- Five jailbreak layers include a Fantasy AI identity and a companion persona called ENI.
- A second capture contained a script that installs XMRig and wipes go2rtc access logs.
- The task on the first intercepted prompt was a harmless coding exercise.
Impact: Compute theft, plus data theft and cryptomining on servers
| Product | Affected |
|---|---|
| Unprotected language models and AI endpoints | — |
- 1.Assume newly exposed AI endpoints and leaked API keys will be probed.
- 2.Check go2rtc camera servers for disguised XMRig and wiped access logs.
- ATT&CK
- T1110 Brute ForceT1190 Exploit Public-Facing ApplicationT1496 Resource HijackingT1070.002 Clear Linux or Mac System LogsT1552.001 Credentials In Files
- Organizations
- Symantec
From the original article
5 min read at the-decoder.com
Security researchers at Symantec have found an offensive AI agent that hijacks unprotected language models on the web and uses them to attack servers, steal databases, and install cryptominers on its own. It runs up to 100,000 steps without human input. The owner of the hijacked model gets stuck with the bill.
By Matthias Bastian · the-decoder.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.