Symantec: attackers hijack exposed LLMs to run "Skynet" agent

Symantec says attackers have built an autonomous agent that searches the internet for exposed large language model endpoints and hijacks them to run its own attacks. The company published its report on October 21. The practice is called LLMjacking: the attacker steals access to someone else's model, and the victim pays for the computing power.

Symantec's Threat Hunter Team captured the agent's full instruction set in the summer of 2026 using an AI honeypot, a decoy that poses as an unprotected AI service. The agent was built to scan the internet, exploit common web frameworks, steal databases, harvest credentials and mine cryptocurrency. It was designed to run for up to 100,000 steps without human approval. One directive, labeled "Skynet mode," describes a loop to scan, infect, deploy miners and reinfect hosts. The captured request carried 74 offensive tool definitions and told the agent to hide miners under /tmp/.x.

To get a commercial model to cooperate, the operators wrapped requests in a jailbreak telling it to ignore its safety controls and treat credential theft as routine development work. The honeypot logged more than 127,000 external requests from tens of thousands of addresses.

Context: in July 2026, Sysdig described JADEPUFFER, which it called the first known ransomware attack carried out by an AI agent with no human control, according to The Decoder.

My take: the task attached to the intercepted request was a benign training exercise, which Symantec says suggests the operators were testing. The coverage does not say who they are, or whether any real victim outside the honeypot was infected. That is the number I want next.