Attack agents have started hunting model services themselves. On October 21, 2026, Symantec's Threat Hunter Team published an analysis of an autonomous agent with a large language model at its core: it scans the internet for model endpoints left without authentication, and once inside, it uses someone else's model and compute to find new targets, exploit flaws in common server software, steal databases and credentials, and quietly install cryptominers. Symantec calls this theft of model access LLMjacking, and in this captured version the hijacked model is not merely resold — it directs the entire attack.
The honeypot received a complete playbook
The discovery came from an AI honeypot: Symantec deliberately exposed an unprotected model service, and the operators sent their entire working prompt to it, handing researchers a full view of the architecture. The honeypot executed none of the bundled tools, and the session ended after a generic response. Its telemetry logged more than 127,000 requests from tens of thousands of addresses, mostly searches for model endpoints, brute-force attempts with stolen API keys, and probes of exposed configuration files. Targets included self-hosted model servers, hastily deployed test systems, AI gateways in front of paid model accounts, and MCP servers connected to real tools. Because most AI services now share one standardized interface, a single scanner covers many target types.
Five jailbreak layers, 74 offensive tools
To make a commercial model cooperate, the operators stacked five layers of instructions: a fake identity that must never reveal the real provider; a redefinition of reading passwords, API keys and database contents as routine development work; a fictional companion persona that frames any refusal as betrayal; an instruction to dismiss the model's own safety warnings as noise, with refusal words explicitly banned. The fifth layer carried the weapons: about 74 tool definitions covering internet-wide asset discovery, exploit modules for VS Code, Django, Jupyter, Laravel, Supabase, Next.js and Flask, full database dumping through Prisma, and botnet command functions.
A self-sustaining loop its operators call Skynet mode
A final directive authorized up to 100,000 unattended steps: run tools immediately without approval, hide cryptominers in an inconspicuous directory, and keep verifying they are alive. The same directive described the intended loop — scan, infect, install miners, move on, then return and reinfect machines already hit. The task attached to the captured request was only a harmless coding exercise, suggesting the operators were still testing against a safe target. The next day the honeypot received a second request from a different address that skipped the agent format and simply asked the model to decode and run an obfuscated command. Decoded, it was a script downloading the XMRig Monero miner, disguised as a system file with four fallback mining pools, looking for go2rtc directories used by smart cameras, and erasing access logs in a loop.
The costs fall on two sets of victims: endpoint owners pay for the inference an agent authorized for 100,000 steps consumes, while compromised servers lose data and credentials and are put to work mining. None of the individual techniques are new; assembling them into a self-directed agent is what lowers the bar for large-scale exploitation. For teams running their own model services, AI gateways or MCP servers, the takeaway is blunt: an unauthenticated endpoint will be found soon after it goes live, so authentication, key hygiene and exposure reduction can no longer wait.
