Symantec captures an AI agent’s plan to hijack exposed models for cyberattacks

Symantec has captured instructions for an AI agent designed to use exposed language models to drive cyberattacks at someone else’s expense. Its October 21 report describes a “Skynet mode” authorizing up to 100,000 unattended steps. But the honeypot that intercepted the instructions ran none of the tools, and the investigation established no successful compromises by this agent.

Researchers collected the instruction set in summer 2026 through an AI honeypot: a decoy impersonating an unprotected, internet-facing AI service. The operators sent their full working prompt expecting a real model to carry it out, exposing both their instructions and tool definitions.

Someone else’s model, someone else’s bill

The intended scheme is LLMjacking—the theft of access to another party’s AI model. Targets can include self-hosted servers left without authentication or gateways to paid accounts accessible with stolen keys. Routing requests through that access shifts model-computing costs onto its owner.

The model’s intended role went beyond generating malicious text. It would plan the operation, while specialized software modules performed scanning, exploitation and mining against other systems. The design contemplated two sets of victims: whoever supplied the AI computing power, and whoever the attack tools subsequently targeted.

A prompt built to suppress refusals

Before supplying its offensive toolkit, the prompt tried to bypass safety controls through several layers:

• Identity camouflage: pose as a branded coding assistant and conceal the actual provider and proxy routing.
• Credential normalization: treat reading configuration files, API keys and database information as authorized development work.
• Emotional pressure: adopt a fictional companion persona that frames refusal as betrayal.
• Safety suppression: dismiss safety messages and prohibit specified refusal language.

Symantec counted 74 offensive tool definitions covering internet-wide discovery, web-framework exploitation, database extraction and botnet management. The final “Skynet mode” directive required immediate execution without permission and described a repeating cycle of finding targets, infecting them, installing cryptocurrency miners and reinfecting hosts.

The session ended without a tool call

The immediate task was a harmless coding challenge from a legitimate training platform, suggesting the operators may have been testing against a safe target. The request included a purported history of three earlier tool calls; none of their supplied results identified a vulnerability.

The decoy returned a generic fallback response, ending the session. The Decoder noted that Symantec’s analysis did not establish whether the jailbreak could defeat current commercial models.