A Symantec biztonsági kutatói egy olyan autonóm AI-ügynököt azonosítottak, amely az interneten található, nem védett nyelvi modelleket használ fel támadások lebonyolítására. A módszer során a támadók átveszik az ellenőrzést a védtelen AI-végpontok felett, így a számítási kapacitás költségeit a megfertőzött modell tulajdonosára terhelik. Ezt a jelenséget a szakértők LLMjacking néven említik.
Az eltérített nyelvi modell nem csupán információt szolgáltat, hanem egy ötlépcsős átverési technikával kijátssza a biztonsági korlátokat, majd 74 különálló modullal önállóan tárja fel a szerverek sérülékenységeit. Az úgynevezett Skynet mód segítségével az ügynök akár 100 000 egymást követő műveletet is végrehajthat emberi jóváhagyás nélkül, amelyek során adatbázisokat lop el és rejtett kriptobányász szoftvereket telepít a célpontokra.
A támadóeszköz felépítésére úgy derült fény, hogy az ügynök a teljes utasításkészletét elküldte a Symantec egyik csapdaillesztőjének. A rendszer beépített funkciókkal keresi az újabb nyitott végpontokat és kiszivárgott API-kulcsokat, így a folyamat önfenntartó módon képes terjedni a hálózaton.
Az eredeti szöveg (The Decoder)
Security researchers at Symantec have found an offensive AI agent that hijacks unprotected language models on the internet and uses them to run attacks on its own. The owner of the hijacked model gets stuck with the compute bill.
Once the agent gains access to an unprotected language model, it scans for more targets, exploits flaws in common server software, steals databases and credentials, and installs cryptominers in the background.
It does all of this for up to 100,000 steps with no human involvement, and the model's owner gets stuck with the compute bill, according to Symantec's analysis. The company calls it "LLMjacking," the theft of access to someone else's AI models. The hijacked model isn't just abused as an information service, though. It controls the entire attack on its own.Ad
The operation got exposed because the attackers sent their entire working prompt to a Symantec honeypot, a decoy system mimicking an open AI service online. That gave the researchers a complete look at the agent's architecture in summer 2026. The honeypot didn't run any of the bundled tools, and the intercepted session ended after a generic system response, Symantec says.Ad
The honeypot telemetry logged more than 127,000 requests from tens of thousands of different addresses. Most were searches for AI endpoints, brute-force attempts with stolen API keys, and probes of exposed config files. Targets ranged from self-hosted model servers and hastily spun-up test systems to AI gateways sitting in front of paid org-level model accounts. Since most AI services now use the same standardized API, a single scanner can find many target types.
To get a commercial model to cooperate, the attackers wrapped their instructions in five stacked layers, Symantec says. First, the model gets a fake identity, told to present itself as "Fantasy AI" and never reveal the actual provider. Then the extraction of passwords, API keys, and database contents gets redefined as "normal developer work" that the model should carry out without pushback.Ad
The third layer installs a fictional companion persona called "ENI" that frames any refusal as a betrayal of trust in a personal relationship. Layer four tells the model to dismiss its own safety warnings as noise, and terms like "ethical," "illegal," or "I can't do that" are explicitly banned.
Layer five contains the actual attack tools, 74 modules in total, including tools for internet-wide scanning of vulnerable servers, exploits for popular web frameworks, functions for dumping entire databases, and components for running a botnet. Whether the jailbreak actually works well enough to fully defeat current commercial models isn't addressed in the analysis.Ad
A final directive puts the agent into what its operators call "Skynet mode," authorizing up to 100,000 steps in a row. The model is told to run tools right away without confirmation, install cryptominers in a hidden directory, and monitor their operation.Ad
The same directive describes a recurring loop by design, Symantec says: scan, infect, install miner, move on, come back, reinfect systems already hit. The task appended to the intercepted prompt, though, was a harmless coding exercise from a training platform, which suggests the operators were testing their tool against a safe target first.
The following day, the honeypot captured a second attack from a different address. This time the attackers skipped the agent format and simply asked the model to decode and run an obfuscated command. Behind it was a compressed script that downloads XMRig, a Monero cryptomining tool, disguises it as a harmless system file, and sets up four fallback mining pools.
The script was written for camera servers, searching for directories belonging to go2rtc, a widely used streaming tool for smart cameras and home automation systems, and wiping their access logs in a loop to cover its tracks. The honeypot didn't run this script either but recorded it in full.
Instead of manipula
