Symantec researchers captured a malicious AI agent that searches for exposed language-model endpoints, hijacks their compute and uses them to direct attacks against other systems. The company calls the theft of model access “LLMjacking.”
A decoy AI service received the attacker’s full working prompt, revealing 74 tools for scanning the internet, exploiting web frameworks, dumping databases, stealing credentials and installing cryptocurrency miners. A five-layer jailbreak tries to override model safeguards, while a so-called Skynet mode authorizes as many as 100,000 autonomous steps without human confirmation.
Symantec’s honeypot recorded more than 127,000 requests from tens of thousands of addresses, including searches for AI APIs, stolen-key attempts and exposed configuration files. The intercepted session did not execute its tools, and the appended task was a harmless coding exercise, so the researchers did not observe that particular prompt complete a real compromise.
A later request carried a cryptomining script targeting camera servers and erasing access logs. The findings show why self-hosted model servers and AI gateways need authentication, key rotation, network restrictions and usage monitoring. An exposed model is not only a data risk; it can become paid infrastructure for someone else’s attack loop.