Hackers are hijacking unprotected AI tools to attack others, and you pay

Security firm Symantec has found a tool that breaks into AI language models left open on the internet and uses them to attack other computers. The hijacked model does the work, and its owner pays the computing bill. Symantec calls the practice "LLMjacking," meaning theft of access to someone else's AI.

What happened

Symantec learned about the tool because attackers sent their full instructions to a decoy, a fake AI service the company set up to attract trouble. That gave researchers a complete look at the tool in summer 2026. The decoy logged more than 127,000 requests from tens of thousands of addresses. Most were searches for open AI services, tries with stolen access keys, and probes of exposed settings files.

How the attack works

Once the tool controls a model, the model plans the attack. It scans for more targets, exploits flaws in common server software, steals databases and passwords, and installs hidden cryptocurrency mining software. Symantec says the tool is allowed up to 100,000 steps in a row with no human input. Its operators call this "Skynet mode."

To get a commercial model to go along, the attackers stacked five layers of instructions. These gave the model a fake identity, called theft "normal developer work," and told it to ignore its own safety warnings. The last layer held 74 attack modules.

A second attack the next day skipped all that. It simply asked the model to run a disguised command. That command downloaded XMRig, a Monero mining tool, and hid it as a harmless file. The script targeted servers running go2rtc, a popular streaming tool for smart cameras and home automation. It also wiped their access logs to cover its tracks.

Who it affects

There are two groups of victims. One is the owner of the exposed AI service, who faces a surprise bill. The other is anyone whose server the agent breaks into, who can lose data and have the machine used for mining. Symantec lists self-hosted model servers, hastily built test systems and AI gateways tied to paid company accounts as targets.

Who can relax

The report does not describe attacks on people who simply use a chatbot app. If your company runs no AI servers of its own and has no go2rtc camera setup, this is mostly background. It still shows where attacks are heading.

What to do

The alert box above lists the steps. The short version is to find out what is reachable from the internet, lock it down, and put limits on spending.

What is not known

Symantec's analysis does not say whether the trick works well enough to beat current commercial models. The decoy also never ran the attack tools, so their real-world results were not observed. The intercepted task was a harmless coding exercise, which suggests the operators were still testing. Symantec says none of the techniques are new, but combining them into a self-directed agent makes large attacks much easier. Its advice is to assume open AI services will be found and probed soon after they go live.