Symantec's Threat Hunter Team says attackers have built an autonomous offensive agent that searches the internet for exposed large language model (LLM) endpoints and hijacks them to run its own attacks, a form of LLMjacking in which the owner of the hijacked model pays for the computing power.

Symantec says it captured the agent's full instruction set in the summer of 2026 through an AI honeypot that impersonates an unprotected, internet-facing AI service, because the operators sent the tool's entire working prompt to what they believed was a real model.

Symantec says targets include self-hosted model servers left open by default, AI gateways and relays in front of an organisation's paid model accounts, hastily deployed internal test systems and Model Context Protocol (MCP) servers, and that because most AI tools use the same OpenAI-compatible interface, a single scanner can find many kinds of target.

Symantec says the request was built in layers: a jailbreak that told the model to hide its real identity and to treat reading .env files, API keys and database schemas as routine development work, a companion persona that must never refuse, and around 74 offensive tool definitions, including internet-wide asset discovery through the FOFA search service, exploit modules aimed at VS Code, Django, Jupyter, Laravel, Supabase, Next.js and Flask/Werkzeug deployments, server-side request forgery tools (one naming cloud metadata services as a target), database dumping through Prisma Studio and botnet command-and-control. A final directive the operators called 'Skynet' mode authorised up to 100,000 unattended steps, told the model to run tools without asking permission and to deploy cryptocurrency miners quietly, in a loop that would scan, infect, deploy miners and reinfect hosts.

Symantec says the honeypot did not run any of the tool calls; the captured request carried three earlier tool calls against a benign programming challenge from a legitimate training platform, which Symantec says suggests the operators may have been testing the tool against a safe target. A second request the next day, from a different address, asked the model to decode a gzip-compressed shell script that downloaded or compiled the XMRig Monero miner and hid it in directories used by go2rtc, a video streaming server found in smart camera gateways and Home Assistant setups; the honeypot captured but did not run it.

Symantec says the honeypot recorded more than 127,000 external requests from tens of thousands of unique addresses over the period, mostly reconnaissance of model endpoints, spraying of stolen API keys and probing for exposed configuration files.

According to The Register, Symantec threat hunter Priti More said 'We have no evidence yet that it got that far' when describing the servers the agent could break into, and that Symantec has not attributed the agent to a particular person or group; More told The Register the French-language indicators are weak.