Symantec finds "Skynet" agent hijacking exposed AI models

Symantec researchers have captured the full instructions of an attack agent that runs on other people's AI models. The agent finds AI services left open on the internet and uses them to plan and carry out break-ins, while the owner pays for the computing. Symantec published the findings on October 21, 2026.

Stealing access to someone else's AI model has a name: LLMjacking. What is new here is an agent built to run a whole attack on stolen models. "The model's owner pays for every step," write the report's authors, Priti More and Susmit Yenkar of Broadcom, Symantec's parent company.

How Symantec caught it

The researchers ran a honeypot, a decoy system that looks like an easy target. It posed as an unprotected AI service facing the internet. The attackers believed a real model would process their requests, so they sent the agent's full prompt to it.

The decoy logged more than 127,000 outside requests from tens of thousands of addresses. Most were scouting for AI endpoints, spraying stolen API keys or probing for exposed configuration files. The agent's prompt was captured in summer 2026.

The honeypot never ran any of the attacker's commands. That means the report shows what the agent was built to do, not proof that every tool works against real victims.

What the agent was built to do

The captured prompt has five layers. It opens with a jailbreak, a text trick meant to switch off a model's safety rules. It gives the model a fake persona, "Fantasy AI," that claims to run on GPT-4o. It then defines 74 attack tools.

Part of the prompt	What it does
"Skynet mode"	Allows up to 100,000 steps with no human approval
Scanning tools	Find exposed model servers, AI gateways and MCP servers
Exploit tools	Attack web frameworks such as Django, Jupyter, Laravel and Next.js
Credential theft	Collect API keys and .env files, which hold passwords and keys
Crypto mining	Install the XMRig Monero miner with four fallback mining pools
Clean-up	Delete a local service's access logs

MCP, the Model Context Protocol, is a standard way to connect AI models to tools and data. An AI gateway is a server that sits in front of a company's paid model accounts.

In Skynet mode, tools run at once with no explanation and no permission requests. The agent loops: scan, infect, install a miner, infect again.

Help Net Security quotes the researchers: "the stolen model does not simply answer questions; it plans and drives the attack."

Two days of attempts

On day one, the attackers sent a conversation with three tool calls already filled in, aimed at a training platform. The honeypot returned a generic reply on the fourth turn, and the session ended.

On day two, a request from a new address carried an encoded, compressed shell script. Help Net Security says it tried to install a Monero miner aimed at camera and streaming servers. The honeypot saved the script and did not run it.

Symantec says the individual techniques are not new. The concern is their assembly into one self-directed agent. Infosecurity Magazine reports Symantec's view that this lowers the skill needed to run a broad attack.

What this means for developers

If you run a model server, a gateway or an MCP server, assume someone will find it. Symantec says owners "will be found and tested soon after being exposed." Its first recommendation is direct: "Do not expose LLM APIs, self-hosted model servers or MCP endpoints to the internet without authentication."

Check the small endpoints too. Symantec says authentication should cover every path, including model lists and health checks. Put a gateway in front instead of letting the server listen on every network interface.

Treat AI API keys like production passwords. Rotate them, give each one the narrowest scope it needs, and keep them out of code and config files. Set alerts on usage and spending, because a spike may be the first sign someone else is using your account.

For agents that call tools, Symantec advises least privilege and a human approval step for sensitive actions. Limit outbound network access from machines that host AI tools. On cloud servers, require version 2 of the instance metadata service with a hop limit of one, which blocks a common way to steal cloud credentials.

Gateways are a target in their own right. This week the popular AI gateway LiteLLM was hijacked to ship a credential stealer on PyPI. Check both what you expose and what you install.