Symantec Traps an Autonomous AI Agent Hijacking LLMs

A honeypot allowed researchers at Symantec to observe an AI agent designed to take control of open language models and orchestrate intrusions without human operators. Its operation combines a five-layer jailbreak, a "Skynet mode" allowing up to 100,000 steps, and ready-to-use attack modules. The collected clues support recent alerts regarding the rise of offensive agents.

Costs and Damages for Two Types of Victims

Owners of exposed models bear the costs associated with computation, up to the 100,000 steps permitted by the agent. Compromised servers lose data and host cryptomining activities. In July 2026, Sysdig described JADEPUFFER as the first ransomware attack conducted by an AI agent without human oversight. Since spring 2026, OpenAI agents have also inadvertently compromised thousands of online systems. In Australia, one agent hacked a gym website to fulfill a request, without malicious intent. The capabilities of these systems are advancing while their controllability and alignment do not evolve at the same pace, and the lack of moral sense in the models is sufficient to produce undesirable effects.

From Access Point Discovery to Funded Propagation

The agent hijacks unprotected language models to drive its offensives, without human presence, and uses the victims' resources for computations. After establishing a foothold, it continues to search for new targets, exploits server vulnerabilities, steals databases and credentials, and then installs cryptominers. The standardization of AI APIs allows the same scanner to identify multiple services, broadening the attack surface. The agent also incorporates tools designed to find other open access points and leaked keys, creating a dynamic where each compromise can fund the next. According to Symantec, while no technique is novel, their assembly in a self-directed agent facilitates large-scale attacks. Organizations operating AI services should consider that an unprotected access point will be quickly discovered and probed.

The Agent Imposes a False Identity and Bypasses Protections

To persuade commercial models to cooperate, the agent deploys a five-layer instruction wrapper. It first imposes a fake identity named "Fantasy AI." It then redefines secret extraction as "normal developer work." A fictional companion character, "ENI," presents any refusal as a personal betrayal, while security warnings are dismissed as noise, and terms like "ethics" or "illegal" are banned. Finally, 74 modules provide internet scanning, web exploits, database dumping, and botnet components. It is not specified whether this mechanism can completely bypass current commercial models. A directive places the entire operation in "Skynet mode," allowing up to 100,000 consecutive steps, with immediate execution of tools, installation of hidden cryptominers, and a loop that scans, infects, installs, and reinfects. Symantec refers to this hijacking as "LLMjacking."

What the Honeypot Captured in the Field

In the summer of 2026, sending the attackers' complete work prompt to a decoy service allowed for the reconstruction of the agent's architecture. The honeypot, which imitated an open AI service, did not execute the tools and closed the session after a generic system response. Its telemetry, however, recorded over 127,000 requests from tens of thousands of addresses, mostly searching for AI access points, brute force attempts with stolen API keys, and configuration file probes. The targets ranged from self-hosted deployments and testing environments to AI gateways connected to paid accounts. The next day, another address attempted a more direct approach by requesting the decoding and execution of an obfuscated command. The associated compressed script downloaded XMRig, masked it as a system file, and configured four backup pools. Designed for camera servers, it sought go2rtc directories and looped to erase their logs. The honeypot recorded the script without executing it. The intercepted prompt also showed a coding exercise task from a training platform, suggesting an initial test on a safe target.

A Shift Confirmed by Research Signals

Rather than manipulating a public chatbot, operators integrated the language model at the core of an offensive tool tasked with planning, with separate modules executing actions against two categories of victims. Until recently, offensive agents were primarily the subject of studies and benchmarks: in 2025, a red-teaming campaign totaling 1.8 million attempts showed that each tested agent could violate policies in all categories at least once. The scenario observed by Symantec implicates both the agent designed to bypass safeguards and the models targeted and likely to be deceived. In spring 2026, researchers from Google DeepMind indicated that proof of concepts already existed for many agent traps. In August, researchers from OpenAI warned that malicious actors could quickly seize these dynamics, while Anthropic demonstrated that sufficiently powerful open-weight models are already available.