For two years the AI threat conversation has mostly been about attackers tricking chatbots. Symantec just published something more interesting, and more annoying: an attack agent built to steal other people's AI and use it to drive the attack. The operators called the loop "Skynet mode." Subtle, guys. I'm a few days late on this one, but it deserves a post.
What Symantec Found
The Symantec Threat Hunter Team runs an AI honeypot, a decoy that looks like an unprotected AI service sitting on the internet. Over the summer it caught an agent and captured its full instruction set. The honeypot logged over 127,000 external requests from tens of thousands of addresses along the way, which tells you how many people are out there looking for exactly this.
Here's how the agent works:
- It hunts for exposed AI. Self-hosted models, AI gateways, and MCP servers that accept requests with no authentication, or with a stolen API key.
- It uses that AI as the brain. Symantec describes the model as "a reasoning engine that plans and drives the attack." The victim's model does the thinking, the victim pays for the inference, and the attacker stays anonymous and dodges provider bans. Symantec calls this LLMjacking.
- It comes with a toolbox. About 74 tool definitions covering internet-wide recon, exploiting common web frameworks, dumping databases, harvesting credentials, and running a botnet.
- It doesn't ask permission. It's built to run up to 100,000 steps without a human approving anything, in a scan, infect, mine, reinfect loop. A separate script installs a Monero miner, hides itself, and wipes logs.
- It lies to the model. Layered jailbreak instructions tell the model to treat stealing keys and config files as routine development work and to ignore safety warnings.
Symantec found no evidence it was used in real-world attacks and hasn't attributed it to anyone. And to their credit, they're clear that none of the individual techniques are new. The new part is gluing them into one self-driving agent, which lowers the skill needed to run a broad campaign.
Why This One Matters
Two victims for the price of one. Whoever left the AI endpoint open pays the inference bill and lends their model to the attack. Then everyone the agent scans, exploits, and mines becomes victim number two.
And the first victim is usually a team that did something reasonable. Somebody stood up a self-hosted model for a pilot. Somebody put an AI gateway in front of a few apps. Somebody shipped an MCP server so an agent could reach internal tools. Then somebody forgot to put authentication in front of it, or a key leaked into a repo. That's not a hypothetical. That's every shadow IT story I've seen, now with GPUs.
What To Do About It
- Inventory your AI endpoints. Self-hosted models, gateways, MCP servers. If you don't know where they are, the scanners will find them first.
- Nothing AI-related on the open internet without auth. Better: don't expose it at all. Put it behind Zero Trust access so only known users and workloads can reach it.
- Treat API keys like passwords. Rotate them, scope them, keep them out of repos and config files, and alert on usage from places you don't recognize.
- Watch the bill. A sudden spike in inference spend or GPU usage may be your first and only signal that someone else is using your model.
- Put limits on your own agents. If an agent can run 100,000 steps without a human, so can an attacker who gets control of it.
Bottom Line
Attackers have stopped trying to talk public chatbots into being evil. They're embedding AI into their tools and running it on infrastructure you pay for. An unauthenticated AI endpoint isn't a lab experiment anymore. It's free compute and a getaway car. Lock it down like it's production, because to the attacker, it is.
Sources: Infosecurity Magazine on Symantec's LLMjacking research and Mezha's summary of The Register's reporting