Symantec finds agent designed to hijack exposed AI models

Symantec captured instructions for an autonomous attack agent that hijacks exposed large language models, as detailed in a company blog post. The agent was designed to use stolen model access to scan for targets, exploit web frameworks, steal credentials and databases, and install cryptocurrency miners.

Symantec recorded the instructions through an AI honeypot during summer 2026. The prompt included about 74 offensive tools covering asset discovery, remote code execution, database extraction, command injection, server side request forgery, and botnet management.

A directive called Skynet mode authorized up to 100,000 unattended steps and told the model to act without requesting human approval. It also instructed the model to hide miners under /tmp/.x and repeatedly scan for and infect new hosts.

The prompt used several jailbreak layers to suppress refusals and frame access to API keys, environment files and database schemas as routine programming work. The honeypot did not run any of the requested tools. The task attached to the captured request was a harmless programming challenge, which Symantec said suggests the operators may have been testing the tool against a safe target.