Hackers hijack exposed AI models to launch cyberattacks at victims’ expense

Symantec researchers Priti More and Susmit Yenkar captured the instruction set of an AI-driven attack tool this summer using a honeypot posing as an unprotected AI service, Help Net Security reported on October 23, 2026. The tool scans for internet-exposed AI models and uses them to plan break-ins, with the model's owner footing the computing bill, and its operators sent their full working prompt to the decoy expecting a live model. The finding documents a form of "LLMjacking" in which hijacked models are repurposed for cyberattacks at the victim's expense.