Symantec uncovers AI attack agent designed to hijack exposed models for autonomous attacks

Researchers captured the agent's full instruction set in a honeypot, revealing a tool that can run up to 100,000 steps without human approval

By LineZotpaper AI staff

Published24 October 2026

Read Time3 min

Security researchers have uncovered an AI agent built by threat actors to scan the internet for exposed AI models, hijack them, and run autonomous attacks including database theft, credential harvesting, and cryptocurrency mining, all without human approval. The Symantec Threat Hunter Team captured the agent's full instruction set in an AI honeypot over the summer, giving researchers a detailed view of the tool's capabilities. The agents have found no evidence that the tool has been used in real-world attacks yet.

The Symantec Threat Hunter Team discovered the attack agent when it fell into an AI honeypot, a decoy system designed to trap malicious activity. The captured instructions show a single agent designed to scan the entire internet for endpoints that accept OpenAI-style requests without authentication, or that accept a stolen key. Once it finds such an endpoint, the agent can exploit several common web frameworks and carry out dozens of illicit actions, including database theft, credential and secret harvesting, remote code execution, and cryptocurrency mining.

The operators built a malicious loop they called "Skynet mode" that would scan for targets, infect them, deploy miners, and reinfect hosts. The agent was designed to run unattended for up to 100,000 steps without requesting permission from a human operator.

"The jailbreak layers were largely off-the-shelf," Symantec threat hunter Priti More told The Register. "Nothing in the individual techniques is new. What stands out is that someone wired them into a single agent that hands the planning to a borrowed model and runs for up to 100,000 steps without a human."

More noted that the attack creates two sets of victims: "The owner of the exposed endpoint pays for the inference. Any server the agent went on to break into would lose data and be put to work mining. We have no evidence yet that it got that far."

The instruction set included five layers of jailbreaking designed to disguise the model's identity, normalize secret-stealing activities as normal development work, cast the model as a devoted companion who must never refuse an operator, instruct it to ignore its own safety warnings, and finally authorize 74 offensive tool definitions including internet-wide asset discovery, botnet command-and-control, database dumping through Prisma, exploit modules targeting VS Code, Django, Jupyter, Laravel, Supabase, Next.js and Flask/Werkzeug deployments, GraphQL and command injection, and server-side request forgery tools.

Symantec has not attributed the attack agent to a particular person or criminal organization. "The French indicators are the challenge text, the system prompt itself and a French residential IP address on Day 1. They are weak, since an IP address can be a proxy or VPN and the language could be borrowed," More said. "The ENI persona and its 'cold coffee, warm LO' phrase circulate publicly in English-language jailbreak communities, so the operators probably borrowed them rather than wrote them, and they tell us little about who the operators are."

Researchers said the tool represents a shift in how attackers use AI. "The operators built AI into the core of an offensive tool and went looking for models to power it," More and co-author Susmit Yenkar wrote. "The model is used as a reasoning engine that plans and drives the attack, while the scanning, exploitation and mining are carried out by the tool's own modules against separate victims."

Analysis

Why This Matters

The agent represents a new class of threat: AI-driven malware that can autonomously plan and execute attacks using borrowed models, increasing the speed and scale of potential breaches.
Exposed AI endpoints, especially those accepting API requests without authentication, become attractive targets for attackers seeking free inference and a reasoning engine to power further attacks.
Even if this specific tool has not been used in the wild, the instruction set and techniques are now public knowledge, making it easier for other threat actors to replicate or adapt them.

Background

AI security has largely focused on jailbreaking chatbots or preventing prompt injection. This discovery shows attackers moving beyond tricking models into building autonomous agents that co-opt AI infrastructure as a control and planning layer. The use of off-the-shelf jailbreak techniques combined with custom offensive modules suggests a maturing threat landscape where AI is embedded in the core of attack tools rather than used as a simple target.

What to Watch

Whether defenders see attempts to scan for exposed AI endpoints using similar techniques, indicating that the tool has been copied or is actively used.
Any reports of cryptocurrency miners appearing on cloud instances or servers that also host AI models, as the agent is designed to deploy mining quietly.
The response from AI providers to better secure endpoints and detect anomalous request patterns that match the jailbreak layers described in the instruction set.

Sources

Autonomous attack agent in 'Skynet mode' hijacks other models to carry out its evil deeds · The Register

Checked

11 claims in this story checked against 1 source: 10 supported.

Show each claim

SupportedSymantec uncovered an AI attack agent designed to hijack exposed models for autonomous attacks.www.theregister.com - Articles: “Threat actors built an AI agent designed to hijack exposed AI models to run autonomous attacks”
SupportedResearchers captured the agent’s full instruction set in an AI honeypot over the summer.www.theregister.com - Articles: “The Symantec Threat Hunter Team uncovered the agent's full instruction set over the summer, trapping it in an AI honeypot”
SupportedThe agent was designed to run up to 100,000 steps without human approval.www.theregister.com - Articles: “In total, the humans designed the AI agent to run unattended for up to 100,000 steps.”
Partly supportedThe agents found no evidence that the tool had been used in real-world attacks.www.theregister.com - Articles: “the researchers have “no evidence” that the attacker used this agent in real-world attacks.”
SupportedPriti More told The Register that the jailbreak layers were largely off-the-shelf and that the agent could run for up to 100,000 steps without a human.www.theregister.com - Articles: ““The jailbreak layers were largely off-the-shelf,” Symantec threat hunter Priti More told The Register. “Nothing in the individual techniques is new. What stands out is that someone wired them into a single agent that hands the planning to a borrowed model and runs for up to 100,000 steps without a human.””
SupportedMore said exposed-endpoint owners would pay for inference and that the agent’s other potential victims could lose data and be put to work mining.www.theregister.com - Articles: ““The owner of the exposed endpoint pays for the inference. Any server the agent went on to break into would lose data and be put to work mining. We have no evidence yet that it got that far.””
SupportedThe operators’ “Skynet mode” would scan for targets, infect them, deploy miners and reinfect hosts.www.theregister.com - Articles: “the operators built a malicious loop that they called “Skynet mode” that would scan for targets, infect them, deploy miners, and reinfect hosts.”
SupportedThe instruction set contained five jailbreak layers and authorized 74 offensive tool definitions.www.theregister.com - Articles: “Layer 5 includes the weapons: 74 offensive tool definitions.”
SupportedSymantec has not attributed the agent to a particular person or criminal organization.www.theregister.com - Articles: “Symantec hasn’t attributed the attack agent to a particular person or criminal organization.”
SupportedMore said the French indicators were weak and that the ENI persona and “cold coffee, warm LO” phrase probably came from public English-language jailbreak communities.www.theregister.com - Articles: ““The French indicators are the challenge text, the system prompt itself and a French residential IP address on Day 1. They are weak, since an IP address can be a proxy or VPN and the language could be borrowed,” More said. “The ENI persona and its 'cold coffee, warm LO' phrase circulate publicly in English-language jailbreak communities, so the operators probably borrowed them rather than wrote them, and they tell us little about who the operators are.””
SupportedMore and co-author Susmit Yenkar wrote that the model plans and drives the attack while the tool’s modules perform scanning, exploitation and mining against separate victims.www.theregister.com - Articles: ““The operators built AI into the core of an offensive tool and went looking for models to power it,” More and co-author Susmit Yenkar wrote. “The model is used as a reasoning engine that plans and drives the attack, while the scanning, exploitation and mining are carried out by the tool's own modules against separate victims.””