Symantec says attackers hijacked exposed AI models for cyberattacks

Symantec says it captured the agent’s full instruction set with an AI honeypot in summer 2026.[1] The company described the resulting record as an unusually complete view of how the agent was built and what it was told to do.[1] Its prompt included 74 callable offensive tool definitions covering reconnaissance, database dumping, remote code execution and botnet command-and-control management.[1] The honeypot recorded more than 127,000 external requests from tens of thousands of unique addresses during the period.[1] Symantec says the request was sent expecting a real model to follow the instructions, not to attack the honeypot itself.[1]

Symantec says the agent was instructed to scan for targets, exploit common web frameworks, steal databases and credentials, and install cryptocurrency miners.[1] Its “Skynet mode” directive described a recurring cycle of scanning, infecting, deploying miners and reinfecting hosts.[1] The agent was designed to run unattended for up to 100,000 steps and execute tools without waiting for human approval.[1] Symantec says the hijacked model plans and drives the attack rather than merely answering questions.[1] The account describes intended capabilities and instructions; the honeypot did not run the agent’s bundled tools.[2]

Symantec calls stealing access to someone else’s AI model “LLMjacking.”[1] It says the model owners pay for the computing power used by the hijacked agent.[1] The Wall Street Journal reports that taking computing power from targets can help hackers avoid AI costs and obscure their identities.[3] Symantec says exposed endpoints can include self-hosted model servers, gateways to paid model accounts, test systems and MCP servers connected to tools.[1] It also says standardized OpenAI-compatible interfaces allow one scanner to search for many kinds of AI endpoint.[1]

Symantec says the operators used a jailbreak instructing commercial models to ignore safety controls and treat credential theft as routine development work.[1] The instructions were arranged in five layers, including identity disguise, reframing access to secrets as ordinary work, suppressing refusals and providing attack tools.[1] However, The Decoder reports that Symantec’s analysis did not address whether the jailbreak could fully defeat current commercial models.[2] The Decoder also reports a second honeypot attack the following day from a different address, asking the model to decode and run an obfuscated command.[2] These reports do not establish that the agent successfully attacked external systems.[2]