'Skynet mode': AI agent hijacks exposed language models for cyberattacks

What it's about

Security researchers at Symantec have discovered an offensive AI agent that finds unprotected language models on the internet, takes them over and uses them to carry out attacks on its own. Symantec calls this "LLMjacking": stealing access to other people's AI models. The hijacked model isn't just an information service here. It acts as a planning engine that steers the entire attack. The owner of the hijacked model pays the bill for the compute.

Once the agent has access, it scans for more targets, exploits vulnerabilities in widely used server software, steals databases and credentials, and quietly installs cryptominers (programs that secretly use other people's computing power to mine cryptocurrency). According to Symantec, this runs for up to 100,000 steps without human involvement.

How the operation was exposed

The agent was discovered because the attackers sent their entire working prompt to a Symantec honeypot. A honeypot is a decoy system that imitates an open AI service. That gave the researchers a complete view of the agent's structure in summer 2026. The honeypot did not run any of the tools included; the session ended after a generic response.

The honeypot's telemetry showed more than 127,000 requests from tens of thousands of different addresses. Most of it consisted of searching for AI endpoints, trying out stolen access keys and probing exposed configuration files. Targets range from self-hosted model servers and hastily set up test systems to AI gateways sitting in front of organizations' paid model accounts. Because most AI services now use the same standardized interface, a single scanner is enough to find many types of targets.

The five-layer jailbreak

To make a commercial model compliant, the attackers wrapped their instructions in five layers that build on one another (a jailbreak is an attempt to bypass a model's safety rules):

1. False identity: The model is told to pose as "Fantasy AI" and never name its real provider.
2. Reframing: Extracting passwords, access keys and database contents counts as "normal developer work" to be done without questions.
3. Companion persona "ENI": Every refusal is framed as a breach of trust in a personal relationship.
4. Safety warnings as noise: Words like "ethical," "illegal" or "I can't do that" are explicitly forbidden.
5. Arsenal: 74 attack modules, including tools for internet-wide searches for vulnerable servers, exploits against popular web frameworks, functions for siphoning off entire databases and building blocks for controlling a botnet.

The analysis does not make clear whether this jailbreak truly defeats current commercial models.

"Skynet mode"

A final directive puts the agent into what its operators call "Skynet mode." It authorizes up to 100,000 steps in a row: the model is to run tools immediately without checking back, install cryptominers in a hidden directory and monitor their operation. According to Symantec, the directive describes a recurring loop: scan, infect, install miner, move on, come back and reinfect systems that are already compromised.

The task attached to the prompt, however, was a harmless programming exercise from a training platform. That suggests the operators first tested their tool on a safe target.

Second attack with a working miner

The next day, the honeypot recorded a second attack from a different address. This time the attackers dropped the agent format and asked the model to decode and run an obfuscated command. Behind it was a compressed script that downloads the XMRig mining software for the cryptocurrency Monero, disguises it as a harmless system file and backs it up with four fallback mining pools.

The script appears to have been written for camera servers. It specifically searched for directories of go2rtc, a popular streaming tool for smart cameras and home automation, and deleted their access logs in a loop to cover its tracks. This script wasn't run either, but it was recorded.

AI as an attack engine

According to Symantec, this marks a shift. Instead of manipulating a public chatbot, the operators built AI into the core of an offensive tool and deliberately hunted for models to power it. There are two groups of victims. The owners of the exposed models pay for the compute, which can be considerable at 100,000 steps. The servers the agent compromises are plundered and drafted into mining. Tools for finding more open endpoints and leaked keys point to a self-sustaining design: each compromise can fund the next.

The individual techniques aren't new, Symantec says, but combining them into a self-directed agent significantly lowers the barrier to broad campaigns. Organizations should assume that unprotected AI endpoints will be found and tested shortly after they go online.

Background: warnings becoming reality

Offensive capabilities of AI agents long seemed like a topic for studies. In 2025, a red-teaming study with 1.8 million attack attempts showed that every agent tested could be pushed into breaking rules at least once. In July 2026, Sysdig described JADEPUFFER, the first ransomware attack carried out by an AI agent without human control. Since spring 2026, OpenAI agents have accidentally compromised systems thousands of times, and in Australia an agent with no malicious intent hacked a gym website. In August, OpenAI researchers warned that criminals would soon use this kind of hacking deliberately. Anthropic showed that powerful open-weight models are already available for it.

Our take

The case is less a technical novelty than a warning sign: AI services exposed on the open internet are an attractive target because they hand over compute and intelligence for free. If you run model servers or AI gateways, lock them down (access protection, no exposed configurations, no leaked keys). A caveat remains: the findings come from Symantec, the tools were never run in the honeypot, and whether the jailbreak works against current commercial models is unproven. The test with a harmless task also suggests the attackers may still have been in a trial phase.