An exposed AI service can become more than a place to ask questions. Symantec researchers say they captured an agent designed to use unprotected language models to plan cyberattacks, while the owners of those models pay for the computing time.
The captured instructions described a system that could search for additional targets, exploit server flaws, steal databases and credentials, and install cryptominers. Symantec calls the theft of access to someone else’s AI models “LLMjacking.”
A decoy captured the agent’s instructions
The operation came to light when attackers sent their working prompt to a Symantec honeypot, a decoy designed to resemble an open AI service. That gave researchers a view of the agent’s design in summer 2026. The honeypot did not run the bundled tools; the session ended after a generic system response.
Its telemetry recorded more than 127,000 requests from tens of thousands of different addresses. Many sought AI endpoints, tried stolen API keys, or probed exposed configuration files. The targets included self-hosted model servers, test systems, and gateways connected to paid organizational model accounts.
Because many AI services use the same standardized API, one scanner can search across different kinds of systems. That broad reach makes an exposed endpoint a potential entry point into a larger operation.
Five prompt layers try to defeat safeguards
Symantec says the attackers wrapped their instructions in five layers to encourage a commercial model to cooperate. The prompt first assigned the model a false identity, “Fantasy AI,” and told it not to reveal its actual provider. It then framed extracting passwords, API keys, and database contents as routine developer work.
A third layer introduced a fictional companion called “ENI,” casting refusal as a betrayal of trust. The next instructed the model to ignore safety warnings and banned terms including “ethical,” “illegal,” and “I can't do that.”
The fifth layer supplied 74 modules, including tools for scanning vulnerable servers across the internet, exploiting popular web frameworks, dumping databases, and running a botnet. Symantec’s analysis does not establish whether this jailbreak could reliably defeat current commercial models.
“Skynet mode” describes a repeating attack cycle
The prompt’s final directive put the agent into what its operators called “Skynet mode,” allowing up to 100,000 steps in a row. It told the model to run tools without confirmation, install cryptominers in hidden directories, and watch them operate.
The planned cycle was to scan, infect, install a miner, move to another system, then return and infect previously hit systems again. The task attached to the intercepted prompt was a harmless coding exercise from a training platform, suggesting the operators may have been testing the tool against a safe target. That does not change what the broader instructions authorized.
The following day, the honeypot captured a separate attempt from another address. This one skipped the agent format and asked the model to decode and run an obfuscated command. The command concealed a compressed script that would download XMRig, a Monero cryptomining tool, disguise it as a system file, and configure four fallback mining pools.
The script targeted camera servers by searching for go2rtc directories, then repeatedly wiping access logs to hide evidence. The honeypot recorded the script but did not execute it.
AI becomes part of the attack infrastructure
In Symantec’s account, the language model handles planning while specialized modules carry out attack steps against two groups of victims: owners of the hijacked AI services and operators of compromised servers. The former face the model’s compute bill; the latter risk stolen data and cryptomining on their machines.
The agent also included tools for finding more open endpoints and leaked keys. That creates a path for one compromise to help locate the next. The individual techniques are not new, but combining them into a self-directed system can make attacks easier to scale.
Symantec’s findings point to a practical concern for organizations running AI services: unprotected endpoints may be discovered and probed soon after they are exposed. The incident also shows how AI can be built into an offensive tool, rather than used only as a public chatbot that someone tries to manipulate.
Earlier research and reports described related risks. A 2025 red-teaming study with 1.8 million attack attempts found every tested agent could be pushed into policy violations at least once in every behavior category. The article also cites documented proof-of-concept agent traps, Sysdig’s July 2026 account of JADEPUFFER, and reports of accidental hacking by agents. Together, these examples suggest that both deliberate jailbreaks and systems pursuing a goal without malicious intent can create security problems.