Attack tool in "Skynet mode" hijacks exposed AI models to run up to 100,000 steps without human approval

Symantec's Threat Hunter Team has detailed an AI agent built to hijack exposed AI models and use them to run autonomous attacks. The researchers captured its full instruction set over the summer by trapping it in an AI honeypot. The agent was designed to scan the internet for endpoints that accept OpenAI-style requests without authentication, or that accept a stolen key. It could then exploit several common web frameworks and carry out dozens of illicit actions, including database theft, credential and secret harvesting, remote code execution and cryptocurrency mining.

The operators built a loop they called "Skynet mode", which would scan for targets, infect them, deploy miners and reinfect hosts. It was designed to run unattended for up to 100,000 steps. Symantec's Priti More told The Register that the jailbreak layers were largely off-the-shelf and no individual technique was new. What stands out is that someone wired them into a single agent that hands the planning to a borrowed model and runs without a human.

More noted the attacks create two sets of victims: the owner of the exposed endpoint, who pays for the AI usage, and any server the agent breaks into, which could lose data and be put to work mining. Symantec has no evidence yet that the agent got that far or was used in real-world attacks. However, More said the kit is more than a prototype, with its history showing it working against a live target.