'Skynet mode' attack agent hijacks exposed AI models for hacking

Threat actors have built an AI agent that hijacks exposed AI models to run autonomous attacks, and it is allowed to take up to 100,000 steps without human approval. The Symantec Threat Hunter Team captured the agent's full instruction set over the summer by trapping it in an AI honeypot.

According to the researchers, the agent scans the internet for endpoints that accept OpenAI-style requests without authentication, or that accept a stolen key. It then exploits common web frameworks and carries out dozens of illicit actions, including database theft, credential and secret harvesting, remote code execution and cryptocurrency mining. The operators called the central loop "Skynet mode": scan for targets, infect them, deploy miners and reinfect hosts.

Layered jailbreaks and 74 tools

The request to the borrowed model is built in five layers. The first two disguise the model's identity and present secret-stealing, such as reading .env files and API keys, as normal development work. The next two cast the model as a devoted companion persona called ENI that must never refuse an operator called LO, and ban words such as "illegal", "ethical" and "I can't" in code responses.

Layer five holds 74 offensive tool definitions. They cover internet-wide asset discovery, botnet command and control, database dumping through Prisma, and remote code execution exploits aimed at VS Code, Django, Jupyter, Laravel, Supabase, Next.js and Flask/Werkzeug. The final directive authorizes the unattended run and tells the agent to deploy miners quietly in the background.

Why it matters

"Nothing in the individual techniques is new," Symantec threat hunter Priti More said. "What stands out is that someone wired them into a single agent that hands the planning to a borrowed model." She noted that the attacks create two sets of victims: the owner of the exposed endpoint pays for the inference, and any server the agent breaks into could lose data and be put to work mining.

Symantec has no evidence yet that the agent was used in real-world attacks, though More said the kit is more than a prototype, with logs showing it working against a live target. The company has not attributed it to any person or group. French indicators, including the challenge text, the system prompt and a French residential IP address, are weak, and the ENI persona circulates publicly in English-language jailbreak communities.

For defenders, the lesson is that attackers are moving beyond tricking chatbots. As More and co-author Susmit Yenkar wrote, the model serves as a reasoning engine that plans and drives the attack, while the tool's own modules do the scanning, exploitation and mining against separate victims.