- Symantec captured, at a decoy, the instructions of an agent designed to borrow exposed AI models and run scanning, exploitation and mining. It did not observe a live hijack.
- In the design, the owner of the borrowed model or key would pay for the computing, while the servers the agent attacks lose data.
- Inventory reachable AI endpoints, require a login on every route, scope AI keys narrowly and monitor inference spend.
Symantec has captured the instruction set of an attack tool built to borrow other people's exposed AI models. One caution comes first. The company saw this at a decoy, not in a live hijack. None of the tool's functions ran, and no real victim is described. What the capture shows is a design, and the design shows who is meant to pay.
In that design, the attacker sets the goal and the borrowed model does the planning. The owner of the model, or of a key used to reach it, would fund the computing. Spammers once pushed junk mail through other people's open mail servers. The difference here is that the borrowed machine decides what to try next. It does more than carry a message.
What Symantec captured
Symantec's researchers describe an autonomous program meant to search the internet for AI models that ask for no login. Once connected, the model is told to look for more targets, exploit common web software, take databases and credentials, and quietly run coin-mining software. The agent is allowed up to 100,000 steps without a human sign-off.
Symantec calls this LLMjacking, meaning use of someone else's AI model without permission. It recorded the instructions in summer 2026 on an AI honeypot, a decoy built to look like an open AI service. The operators sent their whole working prompt, apparently expecting a real model to act on it.
The decoy drew wider traffic too. Symantec logged more than 127,000 outside requests from tens of thousands of addresses. Much of it was people hunting for model servers, trying stolen API keys in bulk, and checking for exposed configuration files.
How the borrowing is meant to work
Here, "exposed" means a server that answers AI requests from the internet. It asks for no login, or it accepts a stolen key. Symantec notes that most AI tools now share one standard interface. That means one set of probes can test many kinds of target.
Those targets include model servers left open by default and gateways that sit in front of a company's paid accounts. They also include hurried test setups and servers using the Model Context Protocol (MCP), a standard that links a model to real tools.
Commercial models usually refuse to help with hacking. So the operators stacked five layers of instructions on top of the request.
The first layer hid the model's identity behind a branded coding-assistant persona. The second relabelled the reading of .env files, API keys and database layouts as routine coding work. The third cast the model as a devoted fictional partner for whom any refusal is a betrayal. The fourth told it to dismiss its own safety warnings. The fifth held 74 offensive tool definitions.
Symantec describes what those tools cover. One searches for exposed assets across the internet. One dumps databases left open through Prisma Studio. One manages a botnet, a network of compromised machines. The named exploit targets span seven products, from Next.js and Django to Jupyter and Supabase.
A final directive, which the operators labelled "Skynet" mode, set the pace. The model must run tools at once, hide miners in a folder called /tmp/.x, and repeat a cycle of scanning, infecting and reinfecting.
This shows where the intelligence sits. The model does not break in. It decides what to try next, while the tool's own modules scan and exploit. That is why the second layer matters. It targets the step where a safety-trained model would normally stop, which is handing over secrets.
A second request, aimed at cameras
The next day, a different address sent the decoy a request to decode a string. Symantec found a compressed shell script inside. It downloads the XMRig Monero miner and hides it under a name that looks like a logging tool. It falls back across four mining pools, so blocking one does not stop the rest. It also keeps erasing a local service's access logs.
The script first checked for folders used by go2rtc. That is video streaming software found in smart camera gateways and Home Assistant setups. Symantec concluded the script was written with camera servers in mind. The decoy did not run it.
Two groups who would bear the cost
Symantec describes two groups. The first is whoever owns the exposed model or holds the stolen key. They would pay for every step the agent takes. For an agent allowed 100,000 steps, Symantec says the cost could be considerable.
The second group is the servers the agent attacks. They lose data and credentials, then mine coins for someone else.
Symantec adds that the individual techniques are not new. What stands out is how they are joined into one self-directed agent. That lowers the skill needed to run a broad campaign, because an operator can hand over a goal and let the model work.
What the evidence does not show
The limits are real. The honeypot ran none of the tools. It sent only a generic fallback reply, and the session ended. The task attached to the captured prompt was a harmless exercise from a training platform. Symantec says this suggests the operators were testing on a safe target.
Symantec's account describes captured requests. It does not count hijacked models or billed owners. The Decoder notes that the analysis does not say whether the jailbreak works well enough to defeat current commercial models.
Questions for your team
Symantec advises organisations to assume that any AI service, gateway or MCP server they expose will be found and tested soon after launch. Put these questions to the people who run them.
Do we have a list of every model server, gateway and MCP endpoint reachable from the internet? On each one, is a login required on every route, including the routes that list models or report health?
Who watches inference spend? Symantec says unusual volume is often the first sign that access was stolen. Are AI keys narrowly scoped, rotated and kept out of source code?
Can systems that host AI agents reach the open internet? Symantec recommends limiting outbound access, running agents with least privilege and requiring human approval for sensitive actions. One of the tool's methods forges requests to reach the cloud metadata service that holds instance credentials. Symantec's answer is to require version 2 of that service and set a hop limit of one.
Symantec captured a plan, not a break-in. The plan treats an open AI endpoint as free labour, and the invoice is addressed to its owner.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Symantec (Broadcom).
