Symantec's Threat Hunter Team said on October 21 that it captured the instructions for an autonomous attack agent. Symantec said the agent is built to find AI model servers left open on the internet and borrow them as its planning engine. The instructions tell the borrowed model to scan for targets, break into web software, steal data and passwords, and quietly install cryptocurrency miners, for up to 100,000 steps without asking a human. Symantec calls the practice LLMjacking: using someone else's AI access so the owner pays the computing bill.
Symantec caught the requests in summer 2026 on a honeypot, a decoy that poses as an open AI service. The decoy ran none of the attacker's tools. The sources give no count of hijacked models or victims. Symantec also counted more than 127,000 requests to the decoy. That total mixes endpoint probing, stolen-key spraying and config-file probing, so it does not measure this tool's reach.
Symantec said most AI tools share one programming style, so one scanner can probe many kinds of server. The model only plans; separate modules do the scanning and mining. Symantec says an open AI endpoint is now a resource attackers hunt. Who lists your exposed model endpoints, whose keys sit in gateways, and who watches AI spend?