Symantec Captures Instructions of an Agent Hijacking Exposed AI Models

Symantec says it has captured the instructions of an autonomous attack agent that borrows other people’s AI models to do its thinking. The report, published 21 October by Symantec researchers Priti More and Susmit Yenkar, describes the agent as built to run up to 100,000 unattended steps. The model’s owner pays for every one of them.

This is a vendor honeypot observation, not a confirmed victim case. Symantec captured the agent’s prompt and requests; it did not watch the agent run. It reports no named victims and no measured losses, and the findings are Symantec’s alone: Infosecurity Magazine re-reports them, and we found no other vendor corroborating the agent as of 21 October 2026.

How Symantec saw it

Symantec runs an AI honeypot that impersonates an unprotected, internet-facing AI service. It captured the agent’s full instruction set in summer 2026 and says it did not execute any of the captured tool calls or scripts. Over the observation period the honeypot logged more than 127,000 external requests from tens of thousands of unique addresses, mostly endpoint reconnaissance, stolen API key spraying and probes for exposed config files. Those counts cover all honeypot traffic, not just this agent.

The agent looks for exposed LLM endpoints, including self-hosted models, AI gateways and MCP servers. Once it finds one, the hijacked model becomes “a reasoning engine that plans and drives the attack,” in Symantec’s words, while separate modules do the scanning, exploitation and mining.

What the instructions contain

The captured material includes about 74 offensive tool definitions, per Symantec, covering:

• Internet-wide asset discovery through FOFA
• Exploit modules for VS Code, Django, Jupyter, Laravel, Supabase, Next.js and Flask/Werkzeug, including debugger PIN recovery
• GraphQL and command injection, and SSRF through HTML-to-PDF generators
• Database dumping through Prisma Studio
• Botnet command and control, including a mode for continuous scanning and infection

The prompt itself is a layered jailbreak aimed at commercial models. Symantec describes identity camouflage (the model is told to present as “Fantasy AI” on GPT-4o and hide its real provider), reading .env files and API keys framed as routine development work, a companion persona for which refusing counts as betrayal, and a rebuttal protocol that tells the model to dismiss its own safety messages. Operators embedded the jailbreak in the tool instead of trying to trick a public chatbot.

The honeypot sessions

On the first day, a request arrived carrying a record of three earlier tool calls and their results (an SSRF probe, fingerprinting and a full vulnerability scan) against what Symantec calls a benign programming challenge target, with none finding a flaw. Symantec says the honeypot ran none of those calls and that the history appears to have been supplied to entice the targeted model. The honeypot returned a generic fallback message and the session ended.

On the second day a request arrived from a rotated address carrying an encoded command. Decoded, it was a gzip-compressed shell script that fetches or builds the XMRig Monero miner, hides it under a logging-utility-style name, configures four pool failovers, sets an immutable attribute on its config and loops to erase a local service’s access logs. The script appears aimed at go2rtc, a streaming server common in smart camera gateways and Home Assistant setups.

Why it matters

Symantec says none of the individual techniques are new. Its concern is the packaging: one self-directed agent lowers the skill needed to run a broad exploitation campaign, and the cost lands on whoever left a model endpoint open. This extends a pattern we covered earlier, from Sysdig’s report of an attacker using an exposed Ollama server as an AI hacking engine to GreyNoise’s honeypot data on mass LLM endpoint scanning. The difference here is the captured operator instructions, which show the end-to-end design.

Our assessment: the jailbreak layers matter less than the exposure. A model with no authentication in front of it is usable whatever its safety tuning says.

What to do

Symantec’s recommendations, paraphrased:

1. Require authentication on all LLM API, model-server and MCP paths, including model-listing and health checks, and do not bind model servers to all interfaces.
2. Treat AI API keys as high-value: rotate them, scope them narrowly, keep them out of code and config, and monitor for unusual inference volume or spend.
3. Restrict outbound network access from AI hosts and tool-enabled agents.
4. Enforce IMDSv2 with a hop limit of one on cloud workloads.
5. Apply least privilege and human approval to sensitive agent actions, and patch or remove from the public internet the exposed software Symantec lists: VS Code servers, Django, Jupyter, Laravel, Supabase and Prisma Studio.

Indicators from Symantec’s report

All values are as listed by Symantec, re-defanged here. We did not independently verify them.

• Shell script SHA-256: fcde1323acceb46fd88f2276c010bb98839dccce03dc512c56d9529428ceec68
• Gzip-compressed script SHA-256: b720a5e7c3a5b1760d15a8833a782f4fe7fc5c62b967fe57f607e72745ec0ccf
• IPs: 86[.]216[.]147[.]228, 13[.]140[.]161[.]91, 207[.]180[.]232[.]206
• Mining pools: mine[.]c3pool[.]com:13333, auto[.]c3pool[.]org:80, auto[.]skypool[.]xyz:6666, xmrpool[.]eu:5555

The report also maps the activity to MITRE ATLAS AML.T0051 and AML.T0054 and a set of ATT&CK techniques. The full list is in the original.

References

• Symantec — Autonomous LLMjacking: “Skynet” Agent Hijacks Exposed AI Models to Run Attacks
• Infosecurity Magazine — Symantec Uncovers AI Agent Hijacking Models for Autonomous Cyber-Attacks