Hackers hijack exposed AI models to launch cyberattacks at victims’ expense

Symantec researchers Priti More and Susmit Yenkar captured the instruction set of an AI-driven attack tool this summer using a honeypot posing as an unprotected AI service, Help Net Security reported on October 23, 2026. The tool scans for internet-exposed AI models and uses them to plan break-ins, with the model's owner footing the computing bill, and its operators sent their full working prompt to the decoy expecting a live model. The finding documents a form of "LLMjacking" in which hijacked models are repurposed for cyberattacks at the victim's expense.

An attack tool built around AI goes looking for AI models that anyone on the internet can reach, then uses them to plan break-ins while the model’s owner pays for the computing power. Symantec captured the agent’s instruction set this summer through a honeypot posing as an unprotected AI service, researchers Priti More and Susmit Yenkar wrote. Its operators sent their entire working prompt to the decoy, expecting a live model on the other end … More https://www.helpnetsecurity.com/2026/10/23/llmjacking-agent-hijacks-exposed-ai-models/ The post Hackers hijack exposed AI models to launch cyberattacks at victims’ expense https://www.helpnetsecurity.com/2026/10/23/llmjacking-agent-hijacks-exposed-ai-models/ appeared first on Help Net Security https://www.helpnetsecurity.com .