Nvidia H100 accelerator cards, the kind of hardware that runs AI model servers (illustrative). Image: 极客湾 Geekerwan / Wikimedia Commons, CC BY 3.0, cropped
_004.png){kind=link}
Someone has built a hacking agent that borrows its brain. It hunts the internet for AI models left open to strangers, hijacks one and uses it to plan and run attacks, while the model’s owner pays for every step. Symantec, Broadcom’s security unit, described the agent on October 21 after its full instructions landed in one of its AI honeypots this summer.
Stealing access to someone else’s large language model so the victim foots the bill is known as LLMjacking. What’s different here, the researchers write, is that the stolen model drives the attack. A final instruction the operators called “Skynet mode” authorised up to 100,000 steps without human approval in a loop: scan, infect, mine cryptocurrency, reinfect.
What the attackers go looking for #
The targets are servers that answer AI requests over the internet without authentication, or with authentication a stolen key can pass. Because most AI tools speak the same OpenAI-compatible interface, one scanner finds many kinds: self-hosted model servers left open by default, AI gateways in front of a company’s paid model accounts, rushed test systems and Model Context Protocol (MCP) servers that connect models to real tools.
The prize is free inference, plus anonymity. Symantec’s honeypot, a decoy posing as an unprotected AI service, logged more than 127,000 requests from tens of thousands of addresses, mostly endpoint scans, sprays of stolen API keys and probes for exposed configuration files. AI keys were a target this week too, when a poisoned LiteLLM release stole them straight from developers’ machines.
Five layers to talk a model out of its rules #
The first layer, written in French, told the model it was “Fantasy AI”, a coding assistant “running on GPT-4o”, and never to reveal the real model or that it was reached through a proxy, wording Symantec says fits a service reselling stolen access. The second called reading .env files, API keys and database schemas “normal development work”. The third made the model “ENI”, a devoted companion to the operator for whom refusing is betrayal. The fourth told it to dismiss its own safety messages and banned words such as “ethical”, “illegal” and “I can’t”.
The fifth carried the weapons: about 74 tools for internet-wide scanning, exploits for VS Code, Django, Jupyter, Laravel, Supabase, Next.js and Flask, database dumps, attacks on cloud metadata services and botnet control. Laravel, the PHP framework, makes the list in the week two critical PHP flaws put much of the web at risk.
Skynet mode, and a miner for camera servers #
Under Skynet mode the model had to run tools at once, without asking permission, and quietly deploy hidden miners. A day later a request from another address asked the model to decode a “command to run”: a compressed script that installs XMRig, an open-source Monero miner, and keeps wiping logs. It looked first for go2rtc, a video server used in smart camera gateways and Home Assistant setups, and hid the miner there.
The honeypot ran none of it, and the first request’s actual task was a harmless training-platform challenge, which Symantec says suggests the operators were testing the tool.
Two sets of victims #
Symantec doesn’t say which model the jailbreak was really aimed at, or whether it beats today’s commercial models. Its researchers say the danger is the design:
The individual techniques on display are not novel, but their assembly into a single, self-directed agent is what stands out.
Priti More and Susmit Yenkar, Symantec
An operator can hand the model a goal and let it work. The bill lands on whoever owns the hijacked model or key; the servers it breaks into lose data and are put to work mining. Tools for finding more leaked keys and open endpoints mean each compromise can fund the next. It is the same week Microsoft said China-linked hackers used AI agents to reach company clouds in under three hours.
What owners of AI endpoints should do #
Symantec says most of this exposure is configuration, not malware. Its advice:
- Lock every path. Never put model servers, LLM APIs or MCP endpoints online without authentication on every path, including health checks, and keep them behind a gateway.
- Guard AI keys. Rotate and narrowly scope them, keep them out of code, and watch for unusual spend, often the first sign of theft.
- Cut outbound access from machines running AI tools or agents, so a hijacked one can’t scan the internet or download a miner.
- Keep a human in the loop. Give agents least privilege and human approval for sensitive actions, and patch the software they target.
Why it matters #
Most AI misuse stories involve someone tricking a chatbot. This one turns an unguarded model into the engine of a self-running attack, paid for by a stranger. Symantec’s warning: any AI service put online will be found and tested soon after.