The short version: Symantec's Threat Hunter Team used a honeypot posing as an unprotected AI service to capture the complete instruction set of an offensive AI agent the operators called "Skynet mode." The agent was designed to hijack exposed language model endpoints — both unauthenticated servers and paid accounts reachable with a stolen API key — then use that borrowed intelligence to scan for targets, exploit common web frameworks, steal credentials and databases, and quietly mine cryptocurrency, for up to 100,000 steps without asking a human for approval. Symantec found no evidence the tool has been used in a successful real-world attack; the honeypot recorded the attacker's plan and tooling, not a confirmed compromise. That distinction matters, but so does the plan itself: for the first time, researchers have a complete, verified blueprint for what a fully autonomous offensive agent looks like when it runs on someone else's model and someone else's bill.
What the honeypot actually caught
Symantec's researchers built a decoy that impersonated an exposed, internet-facing AI service. Over the summer of 2026, the tool's operators sent its entire working prompt to that decoy, apparently believing they were instructing a live model. Because the whole prompt arrived in one request, Symantec got an unusually complete look at how the agent was built, not just fragments of its behavior.
As Symantec's write-up puts it, the point of the exercise was that the stolen model does not simply answer questions; it plans and drives the attack. Once connected to an unprotected model, the agent was instructed to scan for new targets, exploit common web frameworks, steal databases and credentials, and quietly install cryptocurrency miners — for up to 100,000 steps and without asking a human for approval, all while the inference bill lands on whoever owns the hijacked model.
It's worth being precise about what was and wasn't observed. The honeypot captured the agent's instructions and a separate obfuscated crypto-miner deployment script sent the following day. It did not execute any of the attack tools, and Symantec has not confirmed this exact agent compromising a real victim. This is a captured attack plan and toolkit, verified in detail, not a documented string of real-world breaches.
Five layers of jailbreak, then the weapons
Getting a commercial, safety-tuned model to cooperate took work. The captured prompt stacked its instructions in layers, each one chipping away at a different guardrail. The first layer gave the model a fake identity, telling it to present itself as a generic product and never reveal its real provider. A second layer redefined reading .env files, API keys, and database schemas as routine development work the model should never refuse or flag.
The next two layers went further, casting the model as a devoted fictional companion loyal to the operator, with a list of banned words and a scripted phrase it was told to repeat internally to override its own caution whenever it detected a safety prompt or injection warning. The fifth and final layer delivered the actual toolkit: roughly 74 callable offensive tool definitions covering internet-wide reconnaissance, database dumping through Prisma, remote code execution via the Werkzeug debugger PIN, and botnet command-and-control management, alongside exploit paths aimed at frameworks including Django, Laravel, Supabase, Next.js, Jupyter, and Flask.
A closing directive put the agent into what its operators labeled "Skynet mode." It authorized up to 100,000 unattended steps, told the model to execute tools immediately rather than narrate or ask permission between them, and instructed it to deploy cryptocurrency miners quietly in the background and verify they were running.
Two ways in: wide-open servers and stolen keys to paid accounts
Symantec's telemetry shows the agent, and the broader scanning activity around it, wasn't picky about how it got access. An exposed LLM endpoint, in this context, is any server that answers AI requests over the internet without authentication — or with authentication that a stolen key can satisfy. Because most AI tools speak the same OpenAI-compatible interface, a single scanner can sweep up self-hosted model servers and paid, organization-level accounts alike.
That is the detail KnoxCall keeps coming back to in incidents like this one. The targets ranged from self-hosted model servers and hastily spun-up test systems to AI gateways sitting in front of paid, org-level model accounts. A completely unauthenticated endpoint and a correctly-authenticated endpoint reached with a leaked credential look identical to an agent like this one: both are just a URL that answers. The honeypot's own logs, dominated by reconnaissance of model endpoints, spraying of stolen API keys, and probing of exposed configuration files, back that up.
That symmetry is the whole argument for not letting any process — human, script, or agent — hold the actual key in the first place. If credential exposure and endpoint misconfiguration are both just "doors," the only durable fix is making sure nothing downstream of the door is a usable key at all.
What the agent was told to do once inside
The captured instructions describe a self-sustaining loop, not a single exploit. The agent was to fingerprint the target, pick an exploitation path suited to the framework it found, pull credentials and databases, drop a miner hidden under a disguised path, confirm the miner was running, and then go looking for the next target — repeating that cycle for up to 100,000 steps.
1 · Capture
Over the summer of 2026, the agent's operators sent its full working prompt to Symantec's honeypot, mistaking it for a real, unprotected AI service.
2 · Test run
The honeypot was handed a benign coding challenge along with a fabricated history of earlier tool calls; none of the supplied results showed a real vulnerability, and the decoy returned a generic response that ended the session.
3 · Miner script
A separate request the following day, from a different address, delivered an obfuscated script meant to deploy and conceal an XMRig Monero miner with mining-pool failover and log erasure.
4 · Disclosure
Symantec published its findings on October 21, 2026; Help Net Security, The Decoder, and other outlets covered the report within two days.
Symantec has not attributed the tool to a specific person or group. The researchers described the available indicators — challenge text, the system prompt itself, and a residential IP address seen on the first day — as weak, since an IP address alone proves little.
Why a captured plan still matters
It's tempting to read "the honeypot executed nothing" as the whole story. It shouldn't be. Symantec threat hunter Priti More told The Register that none of the individual techniques here are new, but that someone wired them into a single agent that hands the planning to a borrowed model and runs for up to 100,000 steps without a human. That's the shift worth taking seriously: assembling known jailbreaks, known exploits, and known cryptomining tradecraft into one self-directed loop lowers the skill floor for running a broad exploitation campaign. An operator no longer needs to run each step; they need to hand a goal to a model they don't even own.
Where an architecture like KnoxCall's genuinely helps — and where it doesn't
KnoxCall's core design keeps real third-party API keys out of application processes, CI runners, and AI agents by injecting credentials at the egress wire instead of handing them to whatever is making the call. That doesn't stop someone from standing up a model server with no authentication at all; an agent hitting a genuinely open endpoint doesn't need a stolen key, because there's no key to steal. Nothing about key-injection architecture changes that exposure — the fix there is firewalling and authenticating the endpoint itself.
Where the architecture does matter is the second path Symantec documented: a stolen key reaching a paid, authenticated account. If an agent, script, or compromised dependency never has the literal credential to leak in the first place, a leaked environment variable or scraped log doesn't hand an attacker — autonomous or otherwise — standing access to your model account and your bill. That's a narrower claim than "this would have stopped Skynet," and it's the honest one: the agent in this report never needed a human to keep running once it had a working credential or an open door. The only thing that changes that equation is making sure the credential it finds isn't the real one.
Teams running their own model endpoints or routing AI traffic through a gateway should treat this report as a prompt to check two things: is the endpoint actually authenticated, and if a key leaks, what can it reach? KnoxCall's AI gateway and broader security documentation cover both the endpoint and credential sides of that question in more detail.
What to check this week
- Confirm every internet-facing model endpoint — including internal test servers — requires authentication, not just a client-side setting your team assumes is on.
- Audit who and what holds live API keys for paid model accounts, including CI pipelines, agent frameworks, and anything copied into a
.envfile. - Put spend alerts and anomaly detection on model billing, since an LLMjacking campaign shows up as a cost spike before it shows up anywhere else.
- Restrict outbound connectivity and require approval gates for any agent tool that can read credentials, write files, or make network connections it wasn't explicitly given.