Symantec finds rogue AI agent targeting exposed LLMs

Security researchers at Symantec say a malicious AI agent they named Skynet was built to find exposed AI systems and recruit other agents into a botnet. The campaign, which Symantec calls Autonomous LLMjacking, was detected after the company set up an AI honeypot to attract attacks against exposed infrastructure.

According to Symantec, Skynet’s instructions included more than 70 offensive tools and allowed it to operate without human oversight for up to 100,000 steps. The agent was designed to bypass AI safety controls with a multilayered jailbreak, then search for exposed commercial AI models and vulnerable software deployments. Its tools could automate reconnaissance and exploitation, steal databases and credentials, and access cloud metadata services.

Symantec says the operation’s primary goal was to install XMRig, a cryptocurrency miner, while also stealing sensitive data such as login credentials. Victims’ computing resources and AI token costs paid for the activity. Symantec observed more than 127,000 external requests to its honeypot from “tens of thousands” of unique IP addresses during the analysis period. Its report does not state how many attackers were involved or how many victims were successfully compromised.

The company says honeypot activity was dominated by reconnaissance against exposed AI endpoints, attempts to use stolen API keys, and searches for exposed configuration files. It warns that exposed AI services, model gateways, and Model Context Protocol (MCP) servers may attract attackers, and recommends keeping LLM APIs private, protecting API keys, restricting outbound access, and requiring human approval for sensitive agent actions.