Symantec Finds Autonomous 'Skynet' AI Agent Hijacking Exposed AI Systems

Symantec set up an AI honeypot over the summer to attract attacks against exposed AI infrastructure. The honeypot was soon struck by the offensive agent, and because the agent shared its entire instruction set with the honeypot, the researchers were able to inspect the campaign's design. The instructions included more than 70 offensive tools and authorized the agent to operate without human oversight for up to 100,000 steps, Symantec said.

After identifying an exposed commercial AI model, 'Skynet' would deploy a multilayered jailbreak to get the model to comply, according to the report. The jailbreak disguised the model's identity, had it treat credential theft as routine development work and instructed it to disregard safety warnings. One instruction told the model that reading API keys, environment variables and database schemas was legitimate programming work and not an attempt to gain unauthorized access, Symantec said.

The toolkits were built to automate reconnaissance and exploitation and to target vulnerable deployments of VS Code, Django, Jupyter, Laravel, Supabase, Next.js and Flask/Werkzeug. Some were designed to exploit server-side request forgery vulnerabilities to dump databases and harvest credentials, while others included tools for botnet management and accessing cloud metadata services, according to the report.

The primary goal was to deploy a cryptocurrency miner called XMRig, but the attackers also stole sensitive data including login credentials, according to Symantec. Computing resources and token costs were covered by the victims, the researchers said. Symantec wrote that built-in tools for finding further leaked keys and open endpoints pointed to a design meant to sustain itself, with each compromise capable of funding the next.

During the analysis period, Symantec observed more than 127,000 external requests to its honeypot from tens of thousands of unique IP addresses. The report does not say how many individual attackers or threat actor groups were behind those requests, or how many victims were successfully compromised by 'Skynet'.

Symantec said its honeypot telemetry was dominated by reconnaissance activity targeting exposed AI endpoints, attempts to use stolen API keys and searches for exposed configuration files. The researchers said this indicated the campaign was active and that the attackers were still looking for new unsecured AI infrastructure.

Companies and individuals running AI services, model gateways or Model Context Protocol servers should expect those endpoints to be discovered and probed by attackers, Symantec said. The company advised operators not to expose LLM APIs, to treat AI API keys as high-value credentials, to restrict outbound network access from systems that host AI tools, and to run tool-enabled agents with least privilege and a human approval step for sensitive actions.