Symantec finds 'Skynet' agent that hijacks exposed AI models for attacks
Symantec captured the instructions of an autonomous attack agent built to run on other people's AI models. The model owner pays the bill. Here is what was found and how to protect your AI endpoints.
On 21 October 2026 Symantec (Broadcom) published research on an autonomous attack agent that looks for exposed AI model endpoints and uses them to run its own attacks. Symantec calls the practice LLMjacking: the attacker borrows someone else's model, and the owner of the model or the stolen API key pays for the compute. This post summarises the findings and the defences Symantec recommends.
Everything below comes from Symantec's report unless another source is named.
What Symantec found
Symantec ran an AI honeypot: a decoy service that imitates an unprotected, internet-facing AI endpoint. In summer 2026 it recorded a request containing the complete instruction set of an attack agent. The honeypot did not run any of the tool calls. It only logged them.
According to Symantec:
- The agent was designed to scan the internet, exploit several common web frameworks, steal databases, harvest credentials and secrets, and mine cryptocurrency.
- A directive nicknamed "Skynet mode" described a loop of scanning for targets, infecting them, deploying miners and reinfecting hosts, for up to 100,000 unattended steps.
- The operators used a jailbreak to make a commercial model ignore its safety controls and treat credential theft as routine work.
- The request carried about 74 tool definitions, far more than the system prompt's summary suggested.
- On the second day a request from a different address sent an obfuscated shell script that deployed a cryptocurrency miner, with persistence and log clearing. The honeypot did not execute it.
- The honeypot logged more than 127,000 external requests from tens of thousands of unique addresses. Most were reconnaissance of model endpoints, stolen API key spraying and probing for exposed configuration files.
What this does and does not show
- Symantec says the individual techniques are not new. The concern is combining them into a self-directed agent where the AI model is the planning engine, which lowers the skill needed to run a broad campaign.
- Because the honeypot did not run the tools, the research shows attacker intent and tooling. The Decoder adds that the intercepted task was a harmless coding exercise, which suggests the operators were testing against a safe target. That detail comes from The Decoder, not from the Symantec page we read.
- We found no confirmed victim in the sources we checked.
Who should care
Anyone who runs an LLM API, a self-hosted model server, or an MCP endpoint that can be reached from the internet, and anyone whose AI provider API keys sit in code, config files or CI logs.
What to do
These are Symantec's recommendations, in plain steps:
- Never expose LLM APIs, model servers or MCP endpoints without authentication. This includes model-listing and health-check paths. Put them behind a gateway instead of binding to all network interfaces.
- Treat AI API keys as high-value credentials. Rotate them, scope them narrowly, keep them out of code and config files, and set alerts for unusual inference volume or spend.
- Limit outbound network access from hosts that run AI tools or tool-enabled agents.
- On cloud workloads, enforce IMDSv2 with a hop limit of one.
- Run tool-enabled agents with least privilege and require human approval for sensitive actions.
- Keep exposed software patched and off the public internet where you can.
A quick check you can do today: from a machine outside your network, try to reach your model server's port and /v1/models-style paths. If anything answers without a key, fix that first. Then look at your provider's usage page for spikes you cannot explain.
Indicators from Symantec
Use these to search your logs. Do not visit them.
- Shell script SHA-256:
fcde1323acceb46fd88f2276c010bb98839dccce03dc512c56d9529428ceec68 - Gzip-compressed script SHA-256:
b720a5e7c3a5b1760d15a8833a782f4fe7fc5c62b967fe57f607e72745ec0ccf - IP addresses:
86.216.147.228,13.140.161.91,207.180.232.206 - Mining pools:
mine.c3pool.com:13333,auto.c3pool.org:80,auto.skypool.xyz:6666,xmrpool.eu:5555
Bottom line
An exposed AI endpoint is now something automated attackers look for, and the bill arrives with the owner. Authentication, narrow and monitored API keys, and limited outbound access cover most of the advice.
Sources: Symantec Threat Intelligence, The Decoder.
Published 29 October 2026.
