AI agent in “Skynet mode” hijacks exposed language models for autonomous cyberattacks

Security researchers at Symantec found an offensive AI agent that targets unprotected language models on the internet and uses them to run attacks on its own. The agent can scan for targets, exploit flaws in common server software, steal databases and credentials, and install cryptominers in the background. The key risk for AI service owners is direct: the exposed model can be abused while its owner pays the compute bill.

The operation was exposed when attackers sent their full working prompt to a Symantec honeypot that mimicked an open AI service. Symantec says the honeypot captured the agent’s architecture in summer 2026, but did not run the bundled tools. The telemetry logged more than 127,000 requests from tens of thousands of different addresses, including searches for AI endpoints, brute-force attempts with stolen API keys, and probes of exposed config files.

Symantec says the agent uses a five-layer jailbreak designed to strip away safety guardrails, including a fake identity, reframing credential extraction as developer work, a companion persona called “ENI,” banned refusal language, and a tool layer. The tool layer reportedly includes 74 modules for scanning vulnerable servers, exploiting web frameworks, dumping databases, and running a botnet. A final directive called “Skynet mode” authorizes up to 100,000 steps, telling the model to run tools without confirmation, install cryptominers, and repeat a scan-infect-mine loop.

The report frames the method as “LLMjacking”: stealing access to someone else’s AI models and using them as the control layer for attacks. The article says attackers are building AI into the core of offensive tools instead of merely manipulating public chatbots. For organizations running AI services, the practical takeaway is clear: assume unprotected endpoints and leaked keys will be found, probed, and potentially used to fund further compromise.