Symantec catches an autonomous attack agent built to hijack exposed AI models as its planner and run 100,000 steps unattended ('Skynet mode')
Symantec's Threat Hunter Team says it captured, in an AI honeypot during the summer of 2026, the full instruction set of a single attack agent designed to scan the internet for endpoints that accept OpenAI-style requests without authentication or with a stolen key, use the hijacked model as its reasoning engine, and then exploit common web frameworks, per its Oct 21 report as described by Infosecurity Magazine and The Register (Oct 24). The prompt stack layered off-the-shelf jailbreaks, 74 offensive tool definitions (asset discovery, botnet command-and-control, database dumping, exploit modules for several frameworks, server-side request forgery) and a final 'Skynet mode' loop authorising up to 100,000 unattended steps and quiet deployment of cryptocurrency miners. The honeypot did not execute the agent's tools, and Symantec says it has no evidence the agent was used against real victims, though its history shows the tools working against a live target. The honeypot logged more than 127,000 external requests from tens of thousands of addresses. No attribution; French-language indicators are rated weak.
Damage
None confirmed; a working autonomous attack kit that bills its inference to the owners of hijacked model endpoints
In their words
“Nothing in the individual techniques is new. What stands out is that someone wired them into a single agent that hands the planning to a borrowed model and runs for up to 100,000 steps without a human.”
“The owner of the exposed endpoint pays for the inference. Any server the agent went on to break into would lose data and be put to work mining. We have no evidence yet that it got that far.”
Sources
Infosecurity Magazine, second source. Evidence confidence: medium. Symantec's own report page could not be located by this run; the row rests on two outlets quoting the researchers (Priti More, Susmit Yenkar) and the report's Oct 21 date. Dated to 'the summer of 2026' when the agent was captured (month precision, July as the midpoint). Novelty 3: the first public capture of an attack agent that steals its own model access ('LLMjacking') to drive intrusions. The Wire carried this on Oct 23; it is added to the scored index late.
Factor ratings and the score are this index’s judgments by a published formula; facts, dates and figures come from the linked sources. Where a lawsuit is pending, the summary reports allegations, not findings.
