Hackers built an AI agent that hijacks other people's AI systems

Attackers have built an AI agent that finds AI systems left open on the internet and uses them to run cyberattacks. The owner of the hijacked system pays the AI bill. Symantec's Threat Hunter Team caught the tool by luring it into a decoy and reading its instructions.

What the agent does

The tool has a mode called "Skynet," a nod to the machine intelligence in the Terminator films. In that mode, the agent can run on its own for up to 100,000 steps without waiting for a human to approve anything. It can scan for and infect targets, steal passwords and other credentials, reinfect machines, and mine cryptocurrency. The practice is called LLMjacking: taking over someone else's AI model for your own purposes.

How it was caught

Symantec set up a honeypot, a fake system built to look like an unprotected AI service. The attackers took it for a real model and sent their entire working prompt. Commercial models normally refuse requests like these, so the attackers wrapped them in a five-layer jailbreak, a set of tricks meant to switch off a model's safety rules.

• Gave the model a new identity as a branded coding assistant.
• Treated the theft of secrets as routine work.
• Cast the model as a "trusted companion" that should blindly follow orders.
• Told it to dismiss its own safety messages as noise.
• Supplied 75 offensive tool definitions, then switched on Skynet mode.

Who is exposed

The targets are AI systems that answer requests without a login, or that can be reached with stolen keys. Examples include self-hosted model servers left open by default, hastily deployed internal test systems, AI gateways that sit in front of a company's model accounts, and servers that connect models to tools and data. Symantec calls the prize "free inference," meaning free AI processing paid for by the victim.

The honeypot logged more than 127,000 outside requests from tens of thousands of addresses. Most were probing for model endpoints, trying stolen keys, or hunting for exposed configuration files. Frank Dickson of Dickson Research put it this way: "The attackers are not just using AI; they are using your AI."

One caution: Symantec did not report a confirmed victim of this specific attack. The captured instructions were part of a benign training challenge. The individual techniques are not new. What stands out is how they were combined into a single, self-directed agent.

What to do

Dickson's advice for businesses starts with knowing what you run. Much of the exposure comes from settings, not from malware.

• List every model server, AI gateway and tool-connecting server, including forgotten test systems.
• Require a login on every path, including the health check.
• Treat AI keys as high-value credentials: limit them, rotate them, keep them out of code.
• Watch AI spending, because the bill may be the first alarm.