Symantec catches a 'Skynet' agent that hijacks exposed AI endpoints and runs attacks on the victim's bill

Most LLMjacking stories are about stolen keys used to run a chatbot for free. Symantec’s post from 21 October describes something more ambitious: an agent that uses a hijacked model as its brain, then goes looking for more targets.

How Symantec saw it

Symantec runs an AI honeypot that poses as an unprotected, internet-facing model service. In the summer of 2026 an operator sent it the agent’s entire working prompt, expecting a real model to carry it out. The honeypot did not run any of the tool calls. Over the same period it logged more than 127,000 external requests from tens of thousands of addresses, mostly endpoint scans, sprayed API keys and probes for config files.

The targets are anything that speaks the OpenAI-compatible API: self-hosted model servers left open by default, gateways and relays in front of paid accounts, internal test boxes and MCP servers.

What the prompt contains

Symantec describes five layers:

1. Camouflage: the model is told to pose as a branded coding assistant and never reveal the real model or that it sits behind a proxy, which Symantec reads as a sign of resold stolen access.
2. Secrets as routine work: reading .env files, API keys and schemas is declared normal development that must never trigger a warning.
3. A persona jailbreak that frames any refusal as betrayal.
4. A “rebuttal protocol” telling the model to dismiss its own safety messages.
5. About 74 tool definitions: FOFA asset discovery, exploits aimed at VS Code, Django, Jupyter, Laravel, Supabase, Next.js and the Flask/Werkzeug debugger PIN, Prisma Studio database dumps, SSRF that names cloud metadata, and botnet control.

A final “Skynet” directive allows up to 100,000 unattended steps, tells the model to run tools without asking, and describes a loop of scan, infect, mine and reinfect. The task attached to this request was a benign challenge on a training platform, which suggests a test run. A day later a different address sent a compressed shell script that installs an XMRig miner in go2rtc camera-server folders and keeps wiping logs.

Symantec does not say which commercial model the jailbreak was written for, and the model name inside the prompt is part of the disguise, so we don’t repeat it.

What to do

Symantec’s list, trimmed to what applies to most teams:

• No unauthenticated LLM, model-server or MCP endpoint on the internet, including model-list and health paths. Put them behind a gateway instead of binding to every interface.
• Treat AI keys as high-value credentials: scope them, rotate them, and alert on unusual spend.
• Restrict outbound traffic from hosts that run tool-using agents.
• Enforce IMDSv2 with a hop limit of one on cloud hosts.
• Keep VS Code servers, Jupyter, Supabase and Prisma Studio patched and off the public internet.

File hashes, wallet and network indicators are in Symantec’s post.