The Pulse
Symantec Finds ‘Skynet’ Agent Targeting Exposed AI Models
Symantec researchers say an agent dubbed “Skynet” was built to commandeer exposed AI model endpoints for cyberattacks and cryptocurrency mining. Their report describes a 74-tool attack kit and a captured instruction set authorizing up to 10
AI.info Team · Written with AI · fact-checked ·
“The owner of the hijacked model pays for the computing power, while the servers the agent breaks into are stripped of data and put to work mining.”
Priti More and Susmit Yenkar, AI & Cybersecurity Researchers, Enterprise Security Data and ML Team, ESG Broadcom
Symantec researchers say they captured the instructions for an agent designed to hijack exposed AI model services and use them to drive cyberattacks. The report, published October 21, 2026, calls the operation “LLMjacking”: attackers steal access to a model or API key, shifting the inference bill to its owner while using the model to plan attacks elsewhere.
The agent’s operators called one operating directive “Skynet mode.” It told a model to search for targets, exploit vulnerable systems, collect credentials and databases, install cryptocurrency miners and repeat the process—with as many as 100,000 steps and no request for human approval. That figure describes the instructions’ authorized run length, not a verified number of steps the agent completed.
A honeypot captured the agent’s instructions
Symantec says it collected the full instruction set in summer 2026 through an AI honeypot: a service made to resemble an unprotected model endpoint and attract attempts to use AI infrastructure. The operators sent the prompt expecting a working model to carry it out. The honeypot did not execute the tools or the attacks described in the prompt.
The request bundled about 74 offensive tool definitions, including functions for internet-wide asset discovery, database dumping and exploitation of software such as VS Code, Django, Jupyter, Laravel, Supabase and Flask/Werkzeug. Other tools were described as targeting cloud metadata services through server-side request forgery and managing botnet activity. Symantec says the tool list was broader than the brief summary embedded in the request.
The captured session stopped before an attack
The prompt included a record of three earlier tool calls against a training-platform target: an attempted server-side request forgery probe, a fingerprinting step and a vulnerability scan. The supplied history showed no vulnerability found. When the honeypot returned a generic fallback instead of a tool call, the session ended; Symantec says none of the listed calls ran on the honeypot.
A separate request arrived the following day from a different, rotated address. It asked a model to decode an encoded string that turned out to be a compressed shell script. The script was configured to download or compile XMRig, Monero-mining software, and included steps to conceal the miner and erase local service logs. Again, the honeypot captured the request but did not run it.
Exposed endpoints shift costs onto their owners
Symantec says its honeypot recorded more than 127,000 external requests from tens of thousands of unique addresses over the period. The company describes much of that traffic as reconnaissance of model endpoints, attempts to use stolen API keys and searches for exposed configuration files. Those figures cover activity observed by the honeypot; the report does not present them as a count of Skynet infections.
Unprotected endpoints can provide free access to self-hosted models or paid commercial services, while stolen keys can transfer inference costs to the account holder. The report also notes that a compromised service may offer attackers anonymity and let them attempt to override a commercial model’s safety controls. The operators’ plan paired that borrowed reasoning capacity with separate tools for scanning, exploitation and mining.
Authentication is the first defense
Symantec’s recommendations start with keeping model APIs, self-hosted servers and Model Context Protocol endpoints off the public internet unless they require authentication on every route, including health checks and model listings. The company also advises tightly scoping and rotating API keys, monitoring inference usage and spend, and limiting outbound network access from systems running agents.
For tool-enabled agents, Symantec recommends least-privilege access and human approval for sensitive actions, alongside patching or removing public-facing services named in the tool set. The captured requests show the immediate exposure: an endpoint left open to the internet can become someone else’s model session—and leave its owner paying for the computation.