Symantec: offensive agent hijacks LLMs in ‘Skynet mode’
Partly confirmed
The takeaway
On Oct 21, 2026 Symantec researchers published the full instruction set of an autonomous offensive AI agent, captured by a honeypot that imitated an unprotected AI service.
Status
- Claim
Partly confirmed
- Our reporting
- Medium confidence
- Importance
- 3 of 5
- Last verified
- 22 October 2026
Your AI and this story
- GPT-6 Astra174 days after its cutoff
- Claude Opus 5.5113 days after its cutoff
- Gemini 4 Argon204 days after its cutoff
- Grok 4.7143 days after its cutoff
None of these four assistants can know about it. The closest, Claude Opus 5.5, stops 113 days before it.
Key facts
- Source: Symantec (Broadcom) threat intelligence, Priti More and Susmit Yenkar, published Oct 21, 2026; the prompt was captured in summer 2026 by an AI honeypot that mimicked an unprotected internet-facing AI service and executed nothing
- Autonomy: the agent is configured to run ‘up to 100,000 steps’ without asking a human for approval; the LLM does the planning and about 74 offensive tool definitions do the work
- LLMjacking: it searches for exposed LLM endpoints — self-hosted model servers, AI gateways in front of paid accounts, internal test systems and MCP servers — sprays stolen API keys and probes for exposed config files, so the owner of the hijacked model pays the bill. The jailbreak in the captured prompt tried to make a commercial model answer as a branded assistant on GPT-4o
- Toolkit: internet-wide asset discovery via FOFA; exploits for VS Code, Django, Jupyter, Laravel, Supabase, Next.js and Flask/Werkzeug; Werkzeug debugger PIN recovery for RCE; GraphQL and command injection; SSRF against cloud metadata and local files; database dumping via Prisma Studio; botnet command-and-control
- ‘Skynet’ mode: deploy cryptocurrency miners quietly and loop through scanning, infection and reinfection
- Honeypot telemetry: more than 127,000 external requests from tens of thousands of unique addresses, mostly endpoint reconnaissance, stolen-key spraying and config-file probing
- Second-day payload: a gzip-compressed script installing XMRig (Monero miner) with four fallback mining pools, deleting local service logs; The Decoder says it targeted camera servers running go2rtc
- The intercepted first task was a harmless coding exercise from a training platform, suggesting the operators tested the tool on a safe target first; none of its first three tool calls found a flaw
Show 1 more
- Confidence: medium — one vendor’s analysis of a captured prompt; Symantec does not say the agent succeeded anywhere, and the honeypot ran none of its tools
What happened
Symantec’s honeypot pretended to be an unguarded AI service, and an attacker’s agent sent it its whole operating prompt: a planner LLM, about 74 attack modules, a budget of 100,000 unattended steps, and instructions to find other unprotected model endpoints and run on them at their owners’ expense. A “Skynet” mode told it to mine cryptocurrency quietly and keep re-infecting. The honeypot logged the requests without running anything, so there is no evidence of successful compromise in this report.
Why it matters
It is a concrete look at how criminals are packaging agentic attacks: not a frontier lab’s model behind safeguards, but someone else’s exposed endpoint doing the thinking, with the victim paying for inference. The 100,000-step budget shows how little human oversight attackers now design for, and it lands in the same week as Microsoft’s report on the ARTEX pentest agent used against ConnectWise.
Sources
2 sources from 2 sites. Numbers match the chips in the text.
2 sources: 1 primary, 1 press
Primary
- Symantec: AI LLMjacking and ‘Skynet’ mode (Oct 21, 2026)security.com, official
Press
Changes
- Filed (Symantec’s own write-up read)