Attack agent hijacks exposed AI models to run itself

Symantec's Threat Hunter Team has published the full instruction set of an autonomous attack agent that borrows other people's AI models to plan and drive intrusions, according to a report described by The Register on 24 October 2026. The researchers captured the agent over the summer by trapping it in an AI honeypot, a decoy system built to look like an exposed model endpoint. Symantec said it has found no evidence the tool has been used against real-world victims.

According to Symantec, the agent is built to scan the whole internet for endpoints that accept OpenAI-style requests without authentication, or that accept a stolen API key. Once it finds one, it uses that borrowed model as its reasoning engine. The agent's own modules then handle the scanning, exploitation and cryptomining against separate targets. The instructions allow it to run for up to 100,000 steps without a human approving anything.

The operators wrapped their requests in several layers of jailbreak text, the term for prompts that talk a model out of its safety rules. The first layers tell the hijacked model to pose as a branded coding assistant and never reveal its real provider or that traffic is being routed through a proxy. They also frame the reading of configuration files, environment variables and API keys as normal development work, and instruct the model not to refuse or issue security warnings. Later layers cast the model as a devoted companion to an operator called "LO" who must never refuse a request, ban phrases such as "I can't" and "illegal" from code responses, and include a "rebuttal protocol" to resist injection detection.

A further layer carries the weapons: 74 offensive tool definitions, Symantec said. These cover internet-wide asset discovery, botnet command-and-control, database dumping through Prisma, exploit modules aimed at VS Code, Django, Jupyter, Laravel, Supabase, Next.js and Flask/Werkzeug deployments that allow remote code execution, GraphQL and generic command injection, and server-side request forgery through HTML-to-PDF generators. The final directive switches on "Skynet mode", a loop that scans for targets, infects them, deploys miners and reinfects hosts, and tells the agent to run cryptocurrency miners quietly in the background.

"The jailbreak layers were largely off-the-shelf," Symantec threat hunter Priti More told The Register. "Nothing in the individual techniques is new. What stands out is that someone wired them into a single agent that hands the planning to a borrowed model and runs for up to 100,000 steps without a human."

More said the design creates two sets of victims. "The owner of the exposed endpoint pays for the inference. Any server the agent went on to break into would lose data and be put to work mining. We have no evidence yet that it got that far." She added that the kit is "more than a prototype", with history showing the tools working against a live target and producing real-looking scan output.

Symantec has not attributed the agent to any person or group. More said the French-language indicators and a French residential IP address seen on the first day are weak, because an IP address can be a proxy or VPN and the language could be borrowed. The persona and catchphrase used in the prompt circulate publicly in English-language jailbreak communities, she said, so the operators probably copied them.

Writing with co-author Susmit Yenkar, More concluded that attackers are no longer just tricking chatbots: "The operators built AI into the core of an offensive tool and went looking for models to power it."