New to this? Read it in simple words
- Symantec caught the instructions of a criminal AI agent with a decoy server.
- The agent looks for AI models left open online and uses them to plan attacks.
- It was set to run up to 100,000 steps without asking a human.
- Symantec has no evidence that it hit real victims.
- LLMjacking
- Stealing access to someone else’s AI model, so that the owner pays for the computing.
- Honeypot
- A decoy computer that looks easy to attack, set up to catch and study attackers.
- Jailbreak
- Text written to trick an AI model into ignoring its safety rules.
Running an AI model always costs someone money. Some attackers avoid the bill by using other people’s models, which security researchers call LLMjacking. Symantec, the security business of Broadcom, says it has found an attack tool that goes a step further.
Caught by a decoy
Symantec runs an AI honeypot: a decoy server that pretends to be an unprotected AI service on the internet. In the summer of 2026, attackers sent it the full working instructions of their agent, expecting a real model to carry them out.
The honeypot never ran the attackers’ tools, Symantec says. The task attached to the request was a harmless coding exercise from a training platform, so the operators may have been testing their tool on a safe target. Symantec has “no evidence” that the agent was used against real victims, researcher Priti More told The Register.
Over the period, the honeypot logged more than 127,000 outside requests from tens of thousands of addresses. Most were attempts to find AI services or to try stolen keys, Symantec says.
From Symantec’s report of October 21.
What the agent was built to do
The agent looks for AI services that answer requests without a login, or with a stolen key. They include self-hosted model servers, gateways in front of paid AI accounts, and MCP servers that connect models to tools.
Once connected, the borrowed model plans the attack, and 74 built-in tools do the work: scanning, breaking into common web software, stealing data and passwords, and installing hidden cryptocurrency miners. To make a commercial model cooperate, the operators wrapped their request in layers of jailbreak text.
A final instruction, which the operators called “Skynet mode”, allowed up to 100,000 steps without asking a human. It described a loop: find targets, infect them, install miners and come back to infect them again.
Two kinds of victims
The owner of the exposed model pays for every step, and the servers the agent breaks into lose data and are put to work mining, Symantec says. It calls the tool “a shift in how attackers are using AI”, because the model drives the whole attack.
“Nothing in the individual techniques is new,” More told The Register. What stands out, More said, is that they were wired into one agent that runs for a long time without a human. Symantec has not said who is behind it.
Symantec advises never exposing AI services or MCP servers without authentication, treating AI keys like passwords, and watching for unusual spending on AI accounts.
Sources
Every fact in this story comes from the sources below. Open them to check our work.
- 1Primary source · October 21, 2026Autonomous LLMjacking: ‘Skynet’ Agent Hijacks Exposed AI Models to Run Attacks Symantec (Broadcom)
- 2Research · October 24, 2026Autonomous attack agent in ‘Skynet mode’ hijacks other models to carry out its evil deeds The Register
- 3Research · October 21, 2026Symantec Uncovers AI Agent Hijacking Models for Autonomous Cyber-Attacks Infosecurity Magazine
- 4Research · October 22, 2026An AI agent in “Skynet mode” hijacks unprotected language models to launch self-sustaining cyberattacks The Decoder
Everything about the agent comes from Symantec’s own analysis of one captured request. The 100,000 steps are a limit in its instructions, not attacks that happened, and no real victims are known.
Symantec traps an attack agent built to run on hijacked AI. Silicon AI News, October 24, 2026. https://siliconainews.com/stories/symantec-skynet-llmjacking-agent
Symantec caught a criminal AI agent built to hijack exposed models and run 100,000 attack steps unsupervised, though no real victims are known. How we rate the mood
The mood shows how the news frames the event for the tech and AI world: as an opportunity (6 and above) or as a loss (below 5). It is not our verdict on who is right.