Researchers Uncover Autonomous AI Attack Agent That Hijacks Other People's AI Models

Symantec's Threat Hunter Team has uncovered a malicious AI agent designed to run a full cyber-attack without human approval. According to the researchers, it was built to carry out up to 100,000 actions on its own, including scanning for targets, exploiting vulnerabilities, stealing credentials, deploying cryptocurrency miners and reinfecting compromised systems.

The team found it using an AI honeypot, a decoy system that pretends to be an unprotected, internet-facing AI service. The honeypot captured the agent's full instruction set in the summer of 2026, though it did not run the attacker's tools. Symantec published its report on October 21. Over that period the honeypot recorded more than 127,000 external requests from tens of thousands of unique addresses.

The agent hunts for exposed endpoints linked to large language models, including self-hosted models, AI gateways and model context protocol (MCP) servers, to use their computing power for free. This is sometimes called LLMjacking. Symantec noted that the operators shift the cost onto the victim, whether that is processing time or per-token fees, while also gaining anonymity and avoiding account bans from AI providers. The instructions included about 74 tools and layered prompts meant to override commercial models' safety controls by disguising credential theft as legitimate development work. A separate request carried an obfuscated script to install Monero-mining software, hide it and erase logs.