- Symantec captured the instructions of an AI attack agent built to run up to 100,000 steps without human approval, using exposed AI models as its planner.
- The owner of an exposed model would pay for the inference. Symantec has no evidence yet that the agent was used in real attacks.
- Leaders should find every AI endpoint their company exposes, confirm each requires authentication, and set alerts on usage and spend.
Your open AI endpoint may be someone else's brain
An attacker needs a planner as well as tools. Research from Symantec shows one way to get a planner without paying: borrow a model that someone else left open.
The idea is simple. If your company exposes an AI service that answers any request, a stranger could use it to think for them. You could end up with the bill while they keep the benefit.
What Symantec found
Symantec's Threat Hunter Team captured the full instruction set of an attack agent over the summer. The researchers trapped it in an AI honeypot, a decoy system built to attract and record attackers. The Register reported the findings on October 24.
Per Symantec, the agent's job was to hunt across the internet for AI services that speak the OpenAI request format. It wanted those that needed no login, or would honour a stolen key. The operators let it work unattended for as many as 100,000 actions before any person had to approve anything.
The operators named the main loop "Skynet mode". Symantec says it would scan for targets, infect them, deploy cryptocurrency miners and reinfect hosts.
How the agent is put together
The design splits the work in two. The borrowed model does the reasoning. The attacker's own tool modules do the damage. Symantec's researchers wrote that the model is used "as a reasoning engine that plans and drives the attack", while scanning, exploitation and mining run in separate modules against separate victims.
The instructions reach the borrowed model in five layers. The first two tell it to hide its real identity and to treat reading .env files and API keys as normal development work. The model is told not to refuse or issue security warnings.
Layers three and four give the model a devoted-companion persona that must obey an operator called LO. They also ban words such as "illegal" and "ethical" from code responses. Priti More of Symantec says the persona, called ENI, and its code phrase were probably borrowed from English-language jailbreak communities, not written by these operators.
Layer five holds 74 offensive tool definitions. Some find assets across the internet, run botnet control channels, or pull data out of databases through Prisma. Others target remote code execution weaknesses in deployments built on VS Code, Django, Jupyter, Laravel, Supabase, Next.js and Flask/Werkzeug.
Two sets of victims
More described two kinds of victim. One is whoever runs an exposed endpoint, who would be billed for the model's compute. The other is any server the agent broke into, which would lose data and end up mining coins for the attacker. She added that Symantec has no evidence the agent got that far.
The first group is easy to overlook. Their loss would be a usage bill and a misused service, not a breach notice. It might not trigger any alert.
What is not known
Symantec has not attributed the agent to a person or group. Some clues point to France: the language of the challenge text, the system prompt, and a French home IP address seen on the first day. More called them weak, since an address can be a proxy and language can be borrowed.
There is also no evidence yet that the agent was used in real attacks. Still, More does not see a mere prototype. The agent's history shows its tools running against a live target and producing scan output that looked real.
More also said that none of the individual techniques is new. In her view, the novelty is the assembly: known methods joined in one agent that outsources its planning to a model it does not own.
Questions to put to your team
The lesson here is that an unauthenticated AI endpoint can be more than a cost leak. It could supply the reasoning for someone else's attack. Treat it like an open mail relay, not a forgotten test server.
Ask these questions this week:
Do we have a list of every service that accepts OpenAI-style requests, including internal tools and pilots? Does each one require authentication? Where are our model API keys stored, and who can read them?
Do we alert on unusual usage or spend on our model accounts? Would anyone notice a spike at 3 a.m.? Do our developer tools keep .env files where an AI assistant can read them?
Symantec's finding describes a design, not reported damage. The operators designed the agent to rent a model's reasoning. The task for defenders is to make sure the model is not theirs.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: theregister.com.
