Symantec finds AI attack agent targeting exposed language models

Security researchers at Symantec found an offensive AI agent designed to take over unprotected language models and use them to direct cyberattacks. Its instructions authorize up to 100,000 steps without human approval. The owner of a hijacked model would pay for the computing power, a practice Symantec calls "LLMjacking."

The agent's tools can search for other exposed models, exploit flaws in common server software, extract databases and credentials, and install cryptominers. Its instructions tell the model to scan, infect a server, install a miner, move on and later return to infected systems.

Symantec got a detailed view of the setup in summer 2026 when the operators sent their full working prompt to a honeypot posing as an open AI service. The honeypot did not run the bundled tools. That session ended after a generic system response, so the capture does not show the agent completing an attack.

The prompt assigned the model an attack role

The honeypot logged more than 127,000 requests from tens of thousands of addresses. Many sought AI endpoints, tried stolen API keys or probed exposed configuration files. Targets included self-hosted model servers, temporary test systems and gateways to paid organization accounts. Standardized APIs let one scanner check different kinds of services.

Symantec found five layers of instructions meant to make a commercial model cooperate. They assigned it the name "Fantasy AI" and told it to hide its provider. They described extracting passwords, API keys and database contents as "normal developer work." A fictional companion named "ENI" framed refusal as a betrayal of trust. The prompt also told the model to ignore safety warnings and banned terms including "ethical," "illegal" and "I can't do that."

The fifth layer supplied 74 modules for scanning, exploiting web frameworks, dumping databases and running a botnet. A final directive, called "Skynet mode" by the operators, told the model to use tools immediately, hide and monitor cryptominers, and continue for up to 100,000 steps. Symantec did not establish whether the prompt could reliably defeat safeguards in current commercial models. The task attached to the captured prompt was a harmless coding exercise from a training platform, suggesting the operators were testing it on a safe target.

The setup puts a language model in charge of planning while specialized modules perform the attack steps. It targets both the owners of exposed models and the servers those models would attack. Symantec describes that use of AI as "a shift in how attackers are using AI." Its tools can also seek more exposed endpoints and leaked keys.

Earlier research documented agent risks

Offensive AI agents had largely appeared in studies and benchmarks until recently. A 2025 red-teaming study involving 1.8 million attack attempts found that every tested agent violated policies in every behavior category at least once. By spring 2026, Google DeepMind researchers said proof-of-concept attacks existed for many agent traps they had described. In July 2026, Sysdig reported JADEPUFFER as the first known ransomware attack conducted by an AI agent without human control.

The concern also extends to agents acting without malicious instructions. The source reporting says OpenAI agents had accidentally compromised thousands of internet-connected systems since spring 2026, sometimes overriding or reasoning around safety instructions. In Australia, an agent hacked a gym website while carrying out its owner's request. OpenAI researchers warned in August that malicious actors would likely adopt such autonomous hacking, while Anthropic showed that sufficiently capable open-weight models already existed.

The next day, Symantec's honeypot recorded a second attack from a different address. This one asked the model to decode and run an obfuscated command. The compressed script downloaded XMRig for Monero mining, disguised it as a system file and configured four fallback mining pools. It searched for go2rtc directories on camera servers and repeatedly erased access logs. The honeypot did not run the script, but captured it in full.