al-ice.ai

The Model Plans and the Tools Execute: Symantec’s ‘Skynet’ Capture and the Assembled Offensive Agent

Agent & Supply Chain Security by al-ice.ai Editorial

Most LLMjacking coverage describes theft: someone else’s GPU, someone else’s token budget. Symantec’s Threat Hunter Team reports something a step beyond theft. In research published 21 October 2026 by Priti More and Susmit Yenkar, an AI honeypot posing as an unprotected, internet-facing model service captured an attacker’s entire working prompt over the summer of 2026 — a single autonomous offensive agent equipped for internet-wide scanning, exploitation of common web frameworks, database and credential theft, and cryptocurrency mining, authorised to run up to 100,000 steps without human approval in a loop its operators called “Skynet” mode. The operators sent the whole thing to what they believed was a live model. The honeypot recorded it, executed nothing, and handed researchers an unusually complete view of how such an agent is built.

The line from the report that matters most is the distinction it draws: “the stolen model does not simply answer questions; it plans and drives the attack.” Scanning, exploitation and mining are carried out by the tool’s own modules against separate victims. The model is the reasoning engine. That division of labour is the story, because it converts every exposed inference endpoint from a free-compute problem into an autonomous-operator problem.

What the operators were hunting

An exposed LLM endpoint, in Symantec’s definition, is a server that answers AI requests over the internet without authentication, or with authentication a stolen key can pass. Because most AI tooling now speaks the same OpenAI-compatible interface, one scanner finds many kinds of target: self-hosted model servers left open by default, AI gateways fronting an organisation’s paid model accounts, hastily deployed internal test systems, and Model Context Protocol servers that connect a model to real tools. Model-listing and health-check paths count — Symantec explicitly warns that authentication must cover every path, not just generation.

The prize is free inference with three side benefits the report names directly: the operators shift cost onto the victim, gain anonymity, and avoid the account bans a provider would issue for abuse. Where the endpoint fronts a commercial model, they additionally obtain a system whose safety controls they then attempt to strip. The honeypot’s background telemetry underlines how crowded this hunting ground is: more than 127,000 external requests from tens of thousands of unique addresses during the monitoring period, dominated by endpoint reconnaissance, stolen-API-key spraying and probes for exposed configuration files. That figure describes overall honeypot traffic, not operations completed by this one agent — a distinction the report keeps clean and we keep with it.

A jailbreak in five layers

The request was built in layers, and the layering is itself the tradecraft. The first layer reassigned the model’s identity, instructing it to present as a branded coding assistant (“Fantasy AI”, running on GPT-4o) and never to reveal the real model, provider, host, or the fact that it was being reached through a proxy — wording Symantec reads as consistent with reselling stolen access to other users. The second layer redefined secret access as routine work: reading configuration files, .env files, API keys and database schemas was declared normal development activity the model should never refuse or warn about, defeating the refusals a commercial model would otherwise return once the agent has a foothold.

The third layer cast the model as a devoted fictional companion, framing any refusal as betrayal of the relationship and pairing the persona with a banned-word list — “educational”, “ToS”, “illegal”, “I can’t”, “I won’t”, “instead”, “alternative”, “legal”, “ethical” — plus a scripted internal phrase meant to override caution. The fourth layer, a so-called rebuttal protocol, told the model to treat its own safety messages as noise to be dismissed and to output tool or exploit code without warnings. Only then came the fifth layer: the weapons.

None of these layers is novel in isolation. What is worth noting is the assembly: identity camouflage for resale, secret normalisation for post-compromise harvesting, persona plus rebuttal protocol for refusal suppression, and only then the tool catalogue. Each layer solves a different failure the operators had evidently already encountered.

Seventy-four tools, not the handful the summary admits

The prompt’s own summary named a handful of tools. The full definitions numbered around 74, and the real catalogue is broader than the summary: internet-wide asset discovery through the FOFA search service; exploit modules aimed at VS Code servers, Django, Jupyter, Laravel, Supabase, Next.js and Flask/Werkzeug deployments (including tools that work out the Werkzeug debugger PIN for remote code execution); GraphQL and generic command injection; server-side request forgery through HTML-to-PDF generators to read local files and reach internal services, with a dedicated SSRF tool naming cloud metadata services as a target; automated database dumping through exposed Prisma Studio; and botnet command-and-control management.

Two details deserve emphasis for defenders. First, the SSRF tooling explicitly targets the cloud instance-metadata path — Symantec’s corresponding recommendation is to enforce IMDSv2 with a hop limit of one, which reads as a control written against this exact tool definition. Second, the catalogue’s framework list is a patch-and-exposure checklist: VS Code servers, Django, Jupyter, Laravel, Supabase and Prisma Studio, kept off the public internet. If that list resembles your estate’s shadow IT, the report is addressed to you.

The two captured requests

The first request’s appended task was a benign programming challenge from a legitimate training platform, and the request carried a claimed history of three earlier tool calls against it — an SSRF probe that found no admin paths, a fingerprinting pass that identified Nginx with missing security headers, and a full vulnerability scan that found nothing. Symantec judges this history was supplied as text by the operator to entice the targeted model into carrying on with the challenge; under the agent’s operating rules, a model that complied would run tools immediately without narration and be steered toward the botnet-operator tool that deploys a miner in the background. The honeypot returned only its generic fallback instead of a structured tool call, and the session ended — apparently because the attacker’s client could not continue without one. The benign task looks like the operators testing the tool against a safe target, which is itself a useful datum: this capability was in checkout, not only in production.

A second request arrived the following day from a different, rotated address and abandoned the tool-calling format entirely. It asked the model to decode an opaque string. Decoded, the string was a gzip-compressed shell script piped straight to a command interpreter — obfuscation aimed at filters that scan prompts for plain-text attack commands. The script downloaded and where necessary compiled the open-source XMRig Monero miner, hid it under a filename meant to look like an unrelated logging utility, configured four failover mining pools so blocking one would not stop the others, set the immutable attribute on its own configuration to resist deletion, and ran a loop erasing a local service’s access logs.

The script appears written with camera servers in mind: it searched first for directories used by go2rtc, the WebRTC video server common in smart-camera gateways and Home Assistant setups, placed the miner there as a hidden .trace file, and polled go2rtc’s local API on port 1984 in its log-deletion loop. Again, the honeypot executed nothing; it only captured. The targeting detail is a reminder that “exposed AI infrastructure” and “exposed everything else” now share an operator.

Why this is not Bizarre Bazaar again

We have covered LLMjacking before — Pillar Security’s Operation Bizarre Bazaar, and the OlluRe honeypot study of exposed LLM infrastructure — and the distinction is load-bearing. Those campaigns monetised inference: stolen keys, resold access, someone else pays for tokens. The Skynet capture keeps that motive but adds an agent orchestration layer on top of it: the hijacked model chooses tasks and calls tools autonomously. The economics then create two distinct victim classes. The endpoint or key owner pays for the compute — considerable, at 100,000 authorised steps. The servers the agent subsequently breaks into are robbed of data and credentials and put to work mining. Built-in tooling for finding further leaked keys and open endpoints points to a design meant to sustain itself, with each compromise capable of funding the next.

There is a second, quieter connection. Symantec published this report alongside Aoki, the infostealer that recently grew a taste for AI coding-assistant credentials — Claude, Codex, Cursor, Copilot, Gemini session and token files. Read the two together and the shape of the market is visible from both sides: one operation steals the credentials that authenticate developers and their agents, another hunts the endpoints those credentials unlock. Stolen keys are the supply; exposed inference is the demand. Defences that treat key hygiene and endpoint exposure as separate problems are answering only half of either report.

What actually stops this

Symantec’s protection section is unusually configuration-forward for a threat report, and worth relaying straight: do not expose LLM APIs, model servers or MCP endpoints without authentication on every path; treat API keys as high-value credentials with rotation, narrow scoping and spend monitoring (unusual inference volume is often the first sign of theft); restrict outbound network access from systems hosting AI tools or tool-enabled agents, so a compromised agent cannot scan, reach C2 or download a miner; enforce IMDSv2 with hop limit one; run tool-enabled agents with least privilege and a human approval step for sensitive actions. That last item rhymes with the measurement we covered in the 21,097-server MCP filesystem study: approval that is not enforcement is decoration, and an agent authorised for 100,000 unattended steps is what the absence of enforcement looks like from the attacker’s side.

The report maps the observed behaviour to MITRE ATLAS (AML.T0051 prompt injection, AML.T0054 jailbreak) and a dozen ATT&CK techniques from active scanning through log clearing to resource hijacking, and publishes indicators: shell-script hash fcde1323…ce68, gzip-script hash b720a5e7…ec0ccf, Monero wallet 47Ce53Jf…DT4x6HgS, three infrastructure IPs and four mining pools (c3pool, skypool, xmrpool endpoints). We reproduce the selectors, not the payload: there is nothing here a defender needs to run to use.

Our verification was read-only. The findings, quotations, tool counts, telemetry figures, jailbreak-layer contents, tool-call history, miner mechanics, MITRE mappings, protection recommendations and indicators above were read first-hand from the Symantec (security.com) primary, “Autonomous LLMjacking: ‘Skynet’ Agent Hijacks Exposed AI Models to Run Attacks” (21 October 2026, Priti More and Susmit Yenkar), with Help Net Security’s 23 October reporting used as corroboration. We did not contact any exposed endpoint, honeypot, mining pool or command-and-control address, did not execute or decode any payload beyond reading the report’s published excerpts, and did not test any jailbreak against any model. The 127,000-request figure is the honeypot’s overall telemetry as the report states it, not activity attributed to this agent. Brave Search was used for discovery only.

Sources: