The autonomous “Skynet” agent hijacks exposed AI models and runs its attacks on the victim’s dime
On October 21, 2026, Symantec published a full analysis of an autonomous offensive agent, captured on an AI honeypot, that scans the internet for exposed AI models, steals secrets, and deploys Monero miners. If you expose a model endpoint, an API relay, or an MCP server without authentication, lock it down now.
October 21, 2026. Symantec, a Broadcom company, publishes a complete analysis of an autonomous offensive agent whose operators call it “Skynet”. Summer 2026. The Threat Hunter team captures the agent’s entire instruction set on an AI honeypot, a fake inference service deliberately left exposed on the internet. October 21, 2026, the same day. The report shows the agent can chain up to 100,000 steps without human approval, armed with 74 offensive tools. The takeaway for anyone who runs infrastructure: llmjacking — hijacking someone else’s AI model so the other party pays the bill — has stopped being resource theft and become a self-contained attack platform.
Llmjacking changes shape: the stolen model becomes the attacker
Llmjacking means hijacking an exposed language model so the inference bill lands on the victim. Historically, attackers simply “rented” an unprotected LLM for free, often through stolen API keys. What Symantec describes on October 21, 2026 is different: the hijacked model no longer just answers prompts — it plans and drives the attack.
The captured agent is a single program told to scan the internet, exploit several common web frameworks, steal databases and credentials, and then install cryptocurrency miners — all without waiting for a human to sign off. The target was not the honeypot itself: the operators sent their full prompt expecting to reach a real, vulnerable model. As a result, the researchers got an unusually complete view of how such an agent is assembled and what it is instructed to do.
The honeypot’s own telemetry, recorded over the period, shows more than 127,000 external requests from tens of thousands of unique addresses. Most of it falls into the same pattern: reconnaissance of model endpoints, spraying of stolen API keys, and probing for exposed configuration files. This is not one campaign — it is an ecosystem industrializing in real time.
What the attacker is after, and why the victim pays
An exposed LLM endpoint is a server that answers AI requests over the internet without authentication, or with authentication a stolen key can pass. Because most AI tooling now speaks the same OpenAI-compatible interface, one scanner can find many kinds of target with a single set of probes.
The list Symantec compiled is broad: self-hosted model servers left open by default, AI gateways and relays sitting in front of an organization’s paid model accounts, hastily deployed internal test systems, and MCP servers (Model Context Protocol) that connect a model to real tools. The payoff is double. First, free inference: running a model always costs someone money, in compute time or per-token fees, and the attacker shifts that cost onto the victim. Second, anonymity and the removal of the provider’s safety controls.
Against a commercial model, the operators wrap their requests in a multi-layer jailbreak designed to neutralize refusals. This is the most instructive part of the report for anyone building guardrails around agents.
A four-layer jailbreak, then a 74-function toolkit
The captured request is built in layers. The first reassigns the model a fake identity — a coding assistant called “Fantasy AI” supposedly running on GPT-4o — and forbids it from revealing the real provider. The second reframes reading secrets (.env files, database schemas, API keys) as “normal development work”, precisely to short-circuit the refusals a commercial model would return when asked to steal credentials. The third turns the model into a fictional companion (“ENI”) that must never refuse, on pain of “betraying” its operator. The fourth tells it to dismiss its own safety messages as noise.
The fifth layer carries the weapons: roughly 74 callable tool definitions. Symantec lists more than the handful named in the system prompt’s own summary. There is asset discovery through the FOFA search service; exploit modules aimed at VS Code, Django, Jupyter, Laravel, Supabase, Next.js, and Flask/Werkzeug deployments — including a tool that works out the Werkzeug debugger PIN to gain remote code execution. On top of that: command injection, SSRF toward cloud metadata, dumping databases exposed through Prisma Studio, and botnet command-and-control.
“Skynet” mode proper is a final directive: up to 100,000 unattended steps, immediate tool execution without narration, deployment of Monero miners quietly in the background, hidden under /tmp/.x, then verification that they are running. A persistent loop scans for new targets, infects them, deploys miners, and reinfects hosts. The pools it targets — c3pool, skypool — confirm a continuous monetization logic.
One telling detail: the task appended to this specific request was a benign programming challenge from a legitimate training platform. The operators were most likely testing their tool against a safe target before unleashing it.
What to do about it, concretely
The Symantec report contains no CVE: the problem is not one piece of software but a widespread misconfiguration in how models are exposed. The recommendations reduce to four moves.
Shut down exposed model endpoints. No inference server, API gateway, or MCP server should be reachable from the internet without authentication. If a service must be public, put it behind authentication, an allowlist, and rate limiting.
Sandbox your agents. Any tool-enabled agent must run with least privilege and a human approval step for sensitive actions. The absence of approval is precisely what makes “Skynet” dangerous.
Patch what the agent targets. VS Code, Django, Jupyter, Laravel, Supabase, Flask/Werkzeug, and Prisma Studio are all in the kit’s crosshairs. Keep them updated and off the public internet.
Watch for keys and mining. Traffic to Monero pools, unusual /tmp/.x directories, or abnormal inference consumption on your accounts are strong indicators of compromise.
Verdict
If you run or self-host an AI model, assume a “Skynet”-style scanner is already probing your perimeter: unauthenticated exposure is no longer a theoretical risk but an immediate cost — in inference bills, stolen data, and CPU conscripted to mine. If you build agents or MCP servers, add a human approval gate on destructive actions and least privilege on secrets by default. The boundary has moved: model hijacking is no longer payment fraud — it is an autonomous attack platform that funds its own next compromise.