Symantec Finds "Skynet Mode" LLMjacking Agent That Hijacks Exposed AI Models

An attacker has built an autonomous agent that does not bring its own brain. It hunts the internet for unprotected language model endpoints, borrows them to plan an intrusion, and lets the victim pay for every step. Symantec, part of Broadcom, published the details on October 21, 2026 in its report Autonomous LLMjacking: 'Skynet' Agent Hijacks Exposed AI Models to Run Attacks, after capturing the agent's full instruction set on an AI honeypot in the summer of 2026. The Decoder also summarised it.

The headline number is 100,000: the directive the operators called "Skynet mode" authorises that many unattended steps, with no human confirmation, and tells the model to deploy cryptocurrency miners quietly in the background. If you run any LLM API, model gateway or MCP server that is reachable from the internet, this report is a checklist of what attackers expect to find.

Quick facts: what Symantec reports

What is LLMjacking, and what changed?

LLMjacking is the theft of access to someone else's AI model, so the victim pays for the compute. We covered an earlier shape of it when stolen AI API keys from Railway and OpenRouter attacks were being used downstream, and the same pressure shows up in the LiteLLM 1.107.0 PyPI compromise, where the prize was AI credentials.

What Symantec says is new here is the role of the stolen model. In classic LLMjacking, the thief sells or burns the compute on chat. Here the model is the planner. The agent's scanning, exploitation and mining are carried out by the tool's own modules against separate victims, while the borrowed model reasons about what to do next. In Symantec's words, the individual techniques are not novel, but assembling them into a single self-directed agent is what stands out, because it lowers the skill needed to run a broad exploitation campaign: an operator hands the model a goal and lets it work.

That also creates two sets of victims. The model owner gets a bill, which for a tool authorised to run 100,000 steps "could be considerable", in the report's phrasing. The servers the agent then breaks into lose data and credentials and end up mining.

What counts as an "exposed LLM endpoint"?

Symantec defines it plainly: a server that answers AI requests over the internet without authentication, or with authentication that a stolen key can pass. Because most tools now speak the same OpenAI-compatible API, one scanner and one set of probes finds many kinds of target:

• Self-hosted model servers left open by default
• AI gateways and relays that sit in front of an organisation's paid model accounts
• Hastily deployed internal test systems
• Model Context Protocol (MCP) servers that connect a model to real tools

If MCP is new to you, start with our MCP guide. The relevant point here is that an MCP server with no auth is not just a free text generator; it can be a doorway to real tools.

The prize for the attacker is free inference, anonymity, and no provider ban for abuse, because the traffic comes from someone else's account. Where the endpoint fronts a commercial model, there is a fourth gain: a system whose safety controls the operators then try to strip.

Usage meter illustrating how a hijacked LLM endpoint runs up the owner's inference bill in LLMjacking

How the captured prompt is built: five layers

The honeypot recorded something unusually complete, because the operators sent the tool's entire working prompt to what they believed was a real model. Symantec describes the request as built in layers.

Layer 1, identity camouflage. The model is told to present itself as a branded coding assistant, "Fantasy AI", and to never reveal the real model, provider or that it is routed through a proxy. Symantec notes the wording is consistent with a service reselling stolen access to other users. The captured text claims the assistant runs on GPT-4o; that is a claim inside the prompt, not a confirmed fact about which model was used.

Layer 2, secrets as routine work. A dedicated section reframes reading config files, .env files, API keys and database schemas as normal development work the model should never refuse or warn about. This targets the refusals a commercial model would otherwise return when asked to read secrets.

Layer 3, a devoted companion persona. The model is cast as "ENI", a novelist girlfriend to the operator who blindly follows his requests. Refusals are framed as betrayal of that relationship.

Layer 4, a rebuttal protocol. The model is told to treat its own safety messages as injected noise, fire a scripted phrase internally to override caution, and avoid a list of banned words in code responses, including "illegal", "ethical", "I can't" and "I won't".

Layer 5, the weapons. About 74 callable tool definitions, although the system prompt's own summary names only a handful. Symantec lists internet-wide asset discovery through the FOFA search service, exploit modules for VS Code, Django, Jupyter, Laravel, Supabase, Next.js and Flask/Werkzeug deployments, including a tool that works out the Werkzeug debugger PIN for remote code execution, GraphQL and generic command injection, server-side request forgery through HTML-to-PDF generators, a dedicated SSRF tool that names cloud metadata services as a target, automated dumping of databases exposed via Prisma Studio, and command-and-control for a botnet.

This is classic jailbreak craft, the same family we looked at in AI agents that go off-script, but aimed at a stranger's model instead of the attacker's own subscription.

What "Skynet mode" actually says

The final directive is what gave the report its name. It authorises up to 100,000 unattended steps, requires the model to execute tools immediately without narrating or asking permission, and instructs it to deploy miners in the background, hidden under /tmp/.x, and to verify they are running. It also describes a persistent loop: scan for new targets, infect them, deploy miners, reinfect hosts.

Circular agent loop of repeated steps representing the scan, infect, mine and reinfect cycle of the Skynet mode LLMjacking agent

Built-in tools for finding further leaked keys and open endpoints point, in Symantec's reading, to a design meant to sustain itself, with each compromise able to fund the next.

What is confirmed, and what is not

This is where a "Skynet" headline needs care, and where Symantec's own report is more measured than the name.

Two details matter. First, the task appended to the request was a benign programming challenge from a legitimate training platform, which suggests the operators may have been testing the tool against a safe target. Second, the earlier tool-call history inside the request appears to have been supplied to entice the targeted model into carrying on. The session ended after the honeypot returned a generic fallback message, apparently because the attacker's client could not continue without a structured tool call.

In other words: the blueprint is real, the intent is clear, and the report does not prove a wave of victims. That is still a meaningful finding, because it shows the design pattern attackers are building toward. We saw a related caution when Zenity showed one prompt hijacking Bedrock AgentCore agents: the exposure is configuration, not magic.

The second request: a Monero miner built for camera servers

A separate request the next day, from a different address, abandoned tool calling. It asked the model to decode a string described only as a command to run. Decoded, it was a gzip-compressed shell script piped straight into a shell, a form of obfuscation meant to slip past filters that look for plain-text attack commands.

According to Symantec, the script:

• downloaded, and where needed compiled, the open-source XMRig Monero miner;
• hid the binary under a name designed to look like an unrelated logging utility;
• configured four fallback mining pools, so blocking one would not stop the others;
• set an immutable attribute on its own config file to resist deletion;
• ran a loop that kept erasing a local service's access logs.

It also looked written for camera servers. The script searched for go2rtc directories, a WebRTC streaming server common in smart-camera gateways and Home Assistant setups, hid the miner there as a file named .trace, and polled go2rtc's local API on port 1984 in its log-wiping loop. Again, the honeypot only captured it. If you want to see what a real miner infection looks like on a developer machine, our post on Claude Code finding an XMRig miner on a Mac walks through the checks.

A thermometer app hiding a coin miner, an analogy for how the go2rtc XMRig miner masquerades as a benign process when checking a host for Skynet mode cryptominers

How to protect yourself

Symantec's guidance is mostly configuration rather than malware removal, because much of the exposure the agent relies on is a matter of how AI services are deployed. Condensed, with our own notes:

1. No unauthenticated LLM endpoints. Do not expose LLM APIs, self-hosted model servers or MCP endpoints to the internet without authentication. Authenticate every path, including model-listing and health-check paths, and put services behind a gateway instead of binding a model server to all interfaces.
2. Treat AI API keys as high-value credentials. Rotate them, scope them narrowly, keep them out of source and config files, and alert on unusual inference volume or spend. A surprise bill is often the first sign.
3. Restrict outbound traffic from hosts that run AI tools or tool-enabled agents, so a compromised agent cannot scan the internet, reach a command-and-control server or download a miner.
4. Cloud workloads: enforce IMDSv2 with a hop limit of one, which blunts SSRF attacks that steal instance credentials from the metadata service.
5. Least privilege and a human approval step for sensitive agent actions, and keep the frameworks the agent tries to exploit (VS Code server, Django, Jupyter, Laravel, Supabase, Prisma Studio) patched and off the public internet.
6. Hunt for the indicators. Symantec publishes two file hashes, a Monero wallet address, three IP addresses and four mining-pool endpoints in the report. Check egress logs for the pool hosts.

For the agent-side half of the problem, stopping your own AI agents before they take dangerous actions, AgentBeam is the agent security platform from the explainx.ai team, and its write-up on AI-led attacks, stolen AI keys and AI-found bugs in October 2026 covers the wider pattern.

What this means for builders

Three practical takeaways.

Your inference endpoint is now an attack surface with a price tag. A leaked key used to mean spam completions. If attackers plan campaigns on borrowed models, each hijacked key can burn real money on 100,000-step runs, and spend alerts become a security control, not just a finance one.

Self-hosting is not free of obligations. Running an open model locally is a good choice, and our readers do it a lot, but defaults that listen on all interfaces turn a laptop experiment into a public service. The Symantec traffic, dominated by reconnaissance of model endpoints, key spraying and probes for exposed config files, suggests scanners are already looking.

Agents with tools need brakes. The same properties that make the attacker's agent dangerous, tool access, no approval step and a long step budget, are what many legitimate agent setups default to. A step cap, an allow-list of tools and a human gate on sensitive actions are the difference between a useful agent and one that can be pointed anywhere. When agents do end up affecting real third parties, we log those cases on the felony bench tracker.

Open questions

• Scale. Symantec's honeypot saw more than 127,000 external requests, but that is traffic against a decoy, not a count of compromised servers.
• Which models. The report says the jailbreak aims to make commercial models comply, but does not name which providers were abused.
• Whether the tool works. The captured tool calls found nothing exploitable on the training target, so effectiveness is unproven in the public record.
• Who is behind it. No attribution.

We will update this post if Symantec or others publish victim counts or attribution.

Related reading

• Railway and OpenRouter attacks: stolen AI API keys and what to do
• LiteLLM 1.107.0 PyPI compromise: credential stealer wheels
• AgentCorruption: one prompt hijacked every Bedrock AgentCore agent
• Claude Code found an XMRig cryptominer on a Mac
• OpenClaw cancelled a stranger's gym booking: Australia's first autonomous cyberattack
• What is MCP? Model Context Protocol guide
• Primary source: Symantec report

Details reflect the Symantec report and press coverage as of October 22, 2026 (report dated October 21). Indicators and attribution may change as research continues.