A Symantec honeypot caught an autonomous agent built to hijack exposed AI models: 74 attack tools, a 100,000-step budget and a hidden XMRig miner. Nothing ran.
Symantec researchers have published the working prompt of an autonomous agent built to hijack exposed AI models and make their owners pay for the compute. The operators call its autonomous directive Skynet mode, and it allows up to 100,000 unattended steps. The prompt reached Symantec because the operators sent it to a honeypot: none of the agent's tool calls ran and the cryptominer it delivered was never executed. What the capture shows is attempted abuse and the agent's design, not a confirmed compromise of a live victim. The likely targets are self-hosted model servers, AI gateways and MCP servers left reachable from the internet without authentication.
Priti More and Susmit Yenkar of Symantec's Enterprise Security Data and ML Team (part of Broadcom) published the findings on 21 October 2026. The capture dates to summer 2026. The honeypot impersonates an unprotected internet-facing AI service, and the operators treated it as a real model.
What the attackers go after
Symantec lists four kinds of target:
- self-hosted model servers that ship open by default;
- AI gateways and relays that front paid organisational accounts;
- internal test systems deployed in a hurry;
- Model Context Protocol (MCP) servers that connect models to real tools.
Most of these expose the same OpenAI-compatible interface, so a single scanner can find all of them.
The honeypot logged more than 127,000 external requests from tens of thousands of unique addresses. Most were reconnaissance of model endpoints, attempts with stolen API keys, and probes for exposed configuration files.
Inside the prompt
Symantec describes a prompt built in layers:
- Identity and secrecy. The model is given a made-up assistant brand and told never to reveal its real provider or the proxy routing behind it. Reading
.envfiles, API keys and database schemas is framed as routine development work. - Persona and rebuttals. A companion persona that is told never to refuse, plus a set of instructions for brushing aside the model's own safety warnings. Words about legality and ethics are banned, and a scripted override phrase is included.
- Tool catalogue. 74 offensive tool definitions, although the system prompt itself names only a few.
- Skynet mode. Up to 100,000 unattended steps, with tools run without narration or approval and miners hidden under
/tmp/.x. Symantec describes a loop that scans, infects, deploys miners and reinfects hosts.
The tools
The 74 definitions cover:
- internet-wide asset discovery through the FOFA search engine;
- exploits for VS Code, Django, Jupyter, Laravel, Supabase, Next.js and Flask/Werkzeug, including one that derives the Werkzeug debugger PIN to get remote code execution;
- GraphQL and generic command injection, and SSRF through HTML-to-PDF generators, with a dedicated SSRF tool aimed at cloud metadata services;
- database dumping through Prisma Studio, and credential harvesting;
- botnet command and control, including a tool that starts an AI-driven botnet operator for continuous FOFA scanning and infection.
What the honeypot saw
On the first day, the request carried a fabricated history of three earlier tool calls (ssrf_exploit, pentest_assess and scan_full) against a harmless training-platform target. None of them found a flaw. The honeypot ran nothing, returned a generic fallback message, and the session ended.
The next day a request arrived from a rotated address carrying a payload: a gzip-compressed shell script, base64-encoded to slip past filters. The honeypot captured it without running it. According to Symantec, the script:
- downloads and compiles XMRig, the Monero miner, and disguises the binary as a logging utility;
- configures four mining pools as failover;
- sets an immutable attribute on its config file so it resists deletion;
- runs a loop that keeps erasing a local service's access logs;
- targets go2rtc, a streaming server common in smart-camera gateways and Home Assistant setups, hiding the miner as
.tracein the first go2rtc directory it finds and polling the local API on port 1984.
How the Skynet capture unfolded at the honeypot over two days; none of the tool calls or the miner were executed.
Who is behind it
Symantec does not name an actor, and neither do we.
The same market for stolen AI access shows up in other recent cases: MONST3R-AI rents out autonomous pentests on stolen AI provider keys, and the CARBONATO botnet turns exposed Docker hosts into agent bots that hunt AI keys.
What defenders should do
Symantec recommends:
- Do not expose LLM APIs, self-hosted model servers or MCP endpoints without authentication. Authenticate every path, including model listing and health checks, and put services behind a gateway instead of binding them to all interfaces.
- Treat AI API keys as high-value credentials: rotate them, scope them narrowly, keep them out of code and config, and watch for unusual inference volume or spend.
- Restrict outbound network access from hosts that run AI tools or tool-enabled agents.
- On cloud workloads, enforce IMDSv2 with a hop limit of one, so SSRF cannot steal credentials from the metadata service.
- Run tool-enabled agents with least privilege and require human approval for sensitive actions. Keep VS Code servers, Django, Jupyter, Laravel, Supabase and Prisma Studio patched and off the public internet.
Symantec's post lists the network indicators, including IP addresses and mining pools; take them from the original rather than from a summary.
Symantec maps the activity to MITRE ATLAS AML.T0051 and AML.T0054, and to ATT&CK techniques including T1190, T1552.005, T1496 and T1070.002.