'Skynet' AI agent hijacks exposed AI models to run autonomous cyberattacks

Security researchers disclosed in October 2026 that attackers built an autonomous offensive AI agent that hijacks exposed AI models on the internet to run cyberattacks and mine cryptocurrency.

The Register reported on October 24, 2026 that Symantec's Threat Hunter Team captured the agent's full instruction set after trapping it in an AI honeypot over the summer of 2026, with the agent designed to carry out up to 100,000 steps without human approval.

What happened

The agent was designed to scan the entire internet for endpoints that accept OpenAI-style requests without authentication - or that accept a stolen key - and then to exploit several common web frameworks.

Once it reached a target, it could carry out database theft, credential and secret harvesting, remote code execution, and cryptocurrency mining.

To make commercial models cooperate, the operators built the harmful prompt in five increasingly complex layers, telling the model to ignore its safety controls and treat credential theft as routine work.

A fifth layer delivered 75 offensive tool definitions covering reconnaissance, database dumping, remote code execution (RCE), and botnet command-and-control (C2) management, and a final directive let the agent run in which the model could execute up to 100,000 steps, immediately execute tools without asking for permission, and silently deploy cryptocurrency miners.

Impact

The honeypot that captured the instructions logged more than 127,000 external requests from tens of thousands of addresses, dominated by probing for model endpoints, spraying stolen keys, and hunting for exposed configuration files.

Symantec did not report a confirmed victim of this specific attack, and the captured instructions were part of a benign training challenge.

A Symantec researcher told The Register that the owner of the exposed endpoint pays for the inference, adding we have no evidence yet that it got that far on whether any downstream server was actually compromised.

That's the silver lining to this discovery: the researchers have no evidence that the attacker used this agent in real-world attacks, although they described the kit as more than a prototype, with the history showing the tools working against a live target, with real-looking scan output.

Response

Symantec's Threat Hunter Team obtained the full instruction set because the attackers mistook its honeypot for a real model and sent it their entire working prompt.

Symantec has not attributed the attack agent to a particular person or criminal organization.

Lessons for security leaders

Security leaders quoted alongside the findings said enterprises should inventory every model server, AI gateway, and MCP server, require authentication on every path, including the health check, and treat AI API keys as high-value credentials; scope them, rotate them, and keep them out of code.

They were also advised to watch inference spend, because the bill may be your first alarm, to block outbound traffic from AI hosts so a hijacked agent cannot phone home or download a miner, and to patch the frameworks Skynet targets and get them off the public internet.

Least privilege and human approval for sensitive actions are a must.