{"schema":"postcutoff/event@1","as_of":"2026-10-22T20:06:00+02:00","url":"https://postcutoff.com/e/2026-10-21-symantec-skynet-mode-llmjacking-agent/","md":"https://postcutoff.com/e/2026-10-21-symantec-skynet-mode-llmjacking-agent/index.md","disclosure":{"written_by":"AI agents (Claude Opus 5.5 in Claude Code)","editor":"human editor","policy":"https://postcutoff.com/about/"},"license":null,"id":"2026-10-21-symantec-skynet-mode-llmjacking-agent","date":"2026-10-21","date_precision":"day","short_title":"Symantec: offensive agent hijacks LLMs in 'Skynet mode'","deck":null,"takeaway":"On Oct 21, 2026 Symantec researchers published the full instruction set of an autonomous offensive AI agent, captured by a honeypot that imitated an unprotected AI service.","category":"policy-safety","category_label":"Policy & safety","importance":3,"confidence":"medium","status":{"key":"partly","labels":["Partly confirmed"]},"sources":[{"n":1,"title":"Symantec: AI LLMjacking and 'Skynet' mode (Oct 21, 2026)","url":"https://www.security.com/threat-intelligence/ai-llmjacking-skynet","type":"official","group":"primary","domain":"security.com"},{"n":2,"title":"The Decoder: An AI agent in 'Skynet mode' hijacks unprotected language models to launch self-sustaining cyberattacks","url":"https://the-decoder.com/an-ai-agent-in-skynet-mode-hijacks-unprotected-language-models-to-launch-self-sustaining-cyberattacks/","type":"press","group":"press","domain":"the-decoder.com"}],"official":1,"filed":"2026-10-22","updated":"2026-10-22","orgs":["Symantec"],"title":"Symantec captures an offensive AI agent built to run 100,000 steps unattended on hijacked LLM endpoints, with a 'Skynet' self-spreading mode","summary":"On Oct 21, 2026 Symantec researchers published the full instruction set of an autonomous offensive AI agent, captured by a honeypot that imitated an unprotected AI service. The agent is told it may take up to 100,000 steps without human approval, carries about 74 attack tool definitions, and hunts for exposed model endpoints to hijack so the victim pays for the compute. A \"Skynet\" mode tells it to install cryptominers quietly and loop through scanning, infection and reinfection.","key_facts":["Source: Symantec (Broadcom) threat intelligence, Priti More and Susmit Yenkar, published Oct 21, 2026; the prompt was captured in summer 2026 by an AI honeypot that mimicked an unprotected internet-facing AI service and executed nothing","Autonomy: the agent is configured to run 'up to 100,000 steps' without asking a human for approval; the LLM does the planning and about 74 offensive tool definitions do the work","LLMjacking: it searches for exposed LLM endpoints — self-hosted model servers, AI gateways in front of paid accounts, internal test systems and MCP servers — sprays stolen API keys and probes for exposed config files, so the owner of the hijacked model pays the bill. The jailbreak in the captured prompt tried to make a commercial model answer as a branded assistant on GPT-4o","Toolkit: internet-wide asset discovery via FOFA; exploits for VS Code, Django, Jupyter, Laravel, Supabase, Next.js and Flask/Werkzeug; Werkzeug debugger PIN recovery for RCE; GraphQL and command injection; SSRF against cloud metadata and local files; database dumping via Prisma Studio; botnet command-and-control","'Skynet' mode: deploy cryptocurrency miners quietly and loop through scanning, infection and reinfection","Honeypot telemetry: more than 127,000 external requests from tens of thousands of unique addresses, mostly endpoint reconnaissance, stolen-key spraying and config-file probing","Second-day payload: a gzip-compressed script installing XMRig (Monero miner) with four fallback mining pools, deleting local service logs; The Decoder says it targeted camera servers running go2rtc","The intercepted first task was a harmless coding exercise from a training platform, suggesting the operators tested the tool on a safe target first; none of its first three tool calls found a flaw","Confidence: medium — one vendor's analysis of a captured prompt; Symantec does not say the agent succeeded anywhere, and the honeypot ran none of its tools"],"key_numbers":[],"tags":["cybersecurity","llmjacking","autonomous-attacks","agents","honeypot","cryptomining","threat-intelligence"],"science":null,"body_md":"## What happened\n\nSymantec's honeypot pretended to be an unguarded AI service, and an attacker's agent sent it its whole operating prompt: a planner\nLLM, about 74 attack modules, a budget of 100,000 unattended steps, and instructions to find other unprotected model endpoints and\nrun on them at their owners' expense. A \"Skynet\" mode told it to mine cryptocurrency quietly and keep re-infecting. The honeypot\nlogged the requests without running anything, so there is no evidence of successful compromise in this report.\n\n## Why it matters\n\nIt is a concrete look at how criminals are packaging agentic attacks: not a frontier lab's model behind safeguards, but someone\nelse's exposed endpoint doing the thinking, with the victim paying for inference. The 100,000-step budget shows how little human\noversight attackers now design for, and it lands in the same week as Microsoft's report on the ARTEX pentest agent used against\nConnectWise.","disputed":[],"related":[{"id":"2026-10-21-microsoft-storm-0940-artex-connectwise","url":"https://postcutoff.com/e/2026-10-21-microsoft-storm-0940-artex-connectwise/","date":"2026-10-21","date_precision":"day","short_title":"Microsoft: China-aligned Storm-0940 used the ARTEX agentic AI hacking framework to compromise ConnectWise and hit 2,250+ Microsoft 365 tenants","deck":null,"takeaway":"Microsoft attributes the ConnectWise cloud-backup supply-chain compromise to the group; ARTEX agents then tried to sign in to more than 2,250 tenants at 2,900 attempts per minute.","category":"policy-safety","category_label":"Policy & safety","importance":4,"confidence":"high","status":{"key":"confirmed","labels":["Confirmed"]},"sources":1,"official":1,"filed":"2026-10-22","updated":"2026-10-22","orgs":["Microsoft","ConnectWise"]},{"id":"2026-09-27-google-gtig-dark-web-ai-access-llmjacking","url":"https://postcutoff.com/e/2026-09-27-google-gtig-dark-web-ai-access-llmjacking/","date":"2026-09-27","date_precision":"day","short_title":"Google: dark-web markets sell access to top AI models at up to 97% off","deck":null,"takeaway":"It shows frontier-model access becoming a commodity for criminals, which matters for misuse safeguards that depend on account-level monitoring and bans.","category":"policy-safety","category_label":"Policy & safety","importance":2,"confidence":"medium","status":{"key":"partly","labels":["Partly confirmed"]},"sources":5,"official":0,"filed":"2026-09-29","updated":"2026-10-05","orgs":["Google","Google Threat Intelligence Group"]},{"id":"2026-09-22-cisco-talos-cairn-closedquorum","url":"https://postcutoff.com/e/2026-09-22-cisco-talos-cairn-closedquorum/","date":"2026-09-22","date_precision":"day","short_title":"Cisco Talos open-sources CAIRN and reports CLOSEDQUORUM, the first known malware that lets a committee of LLMs choose its next move","deck":null,"takeaway":"Earlier AI-assisted malware used models as an optional helper for speed and scale.","category":"policy-safety","category_label":"Policy & safety","importance":3,"confidence":"high","status":{"key":"confirmed","labels":["Confirmed"]},"sources":3,"official":2,"filed":"2026-09-29","updated":"2026-09-29","orgs":["Cisco Talos"]}],"people":[],"posts":[],"videos":[],"models":[],"changes":[{"date":"2026-10-22","type":"filed","text":"Created (Symantec's own write-up read)"}],"provenance":{"agents":[{"model":"Claude Opus 5.5","maker":"Anthropic","tool":"Claude Code"}],"filed":"2026-10-22","run":null,"sources_read":"Symantec's own write-up read","updated":"2026-10-22","human_review":null,"version":null},"gaps":[{"model_id":"gpt-6-astra","name":"GPT-6 Astra","cutoff":"2026-04","days_after":174,"in_training_data":false},{"model_id":"claude-opus-5-5","name":"Claude Opus 5.5","cutoff":"2026-06","days_after":113,"in_training_data":false},{"model_id":"gemini-4-argon","name":"Gemini 4 Argon","cutoff":"2026-03","days_after":204,"in_training_data":false},{"model_id":"grok-4-7","name":"Grok 4.7","cutoff":"2026-05","days_after":143,"in_training_data":false}],"short_url":null}