Rogue Agent Hijacks Exposed LLM Endpoints in Skynet Mode

Key Takeaways

• Symantec captured an autonomous attack agent that hunts for exposed self-hosted models, AI gateways and MCP servers.
• The agent hijacks those endpoints as its reasoning engine, a technique known as LLMjacking.
• Its "Skynet mode" loop scans, exploits, deploys cryptominers and reinfects with up to 100,000 unapproved steps.
• Symantec's honeypot logged over 127,000 requests but did not run the agent's tools, and no completed compromises were confirmed.

Your Open Model Server Is Someone Else's Brain

An autonomous attack agent is scanning the internet for unprotected AI infrastructure to borrow. As Infosecurity Magazine reported, Symantec found the agent through a honeypot posing as an exposed AI service, and recovered instructions that turn hijacked models into the engine for a broad, unattended hacking campaign.

What We Know

Symantec's Threat Hunter Team published its analysis on October 21, 2026, after capturing the agent's instruction set during the summer. The honeypot imitated an unauthenticated, internet-facing AI service and recorded more than 127,000 requests from tens of thousands of addresses. The Register covered the findings on October 24.

The agent searches for self-hosted model servers, AI gateways and MCP servers, plus endpoints that accept stolen provider keys. It carries roughly 74 tools for reconnaissance, web framework exploitation, database theft, credential harvesting and botnet control, with layered prompts meant to override commercial model safeguards. An obfuscated script installs Monero mining software and erases logs. Symantec saw signs of live-target activity but did not confirm completed server compromises.

What Happened

The failure on the victim side is simple misconfiguration: AI endpoints exposed to the internet without authentication. Popular self-hosting tools ship with no built-in login, and gateways or MCP servers stood up for experiments often keep that default. Anyone who finds them can send prompts and spend the owner's compute or API credit.

What is new is the attacker using AI autonomy against that exposure. Rather than a person manually abusing one endpoint, an agent finds many, uses their models to plan and execute the next steps and loops without human approval. A hijacked MCP server is worse than a hijacked model, because its tools can reach files, databases or internal APIs.

Why It Matters

Organizations with exposed AI endpoints pay the bill, as compute time or per-token fees, and may find their infrastructure powering attacks on third parties, with the liability that follows. Stolen or abused provider keys have already produced large unexpected charges, as seen when the OpenCode Console breach leaked linked OpenAI, Anthropic and Google keys.

The case also shows how cheaply agentic tooling scales old attacks. Individual techniques are familiar, but packaging them in a self-directed agent lowers the skill needed for a wide campaign. Treating AI compute as a governed asset with an owner, inventory and access controls is now a basic hygiene requirement.

PointGuard AI Perspective

You cannot protect AI endpoints you do not know about. PointGuard AI Discovery inventories self-hosted models, gateways and MCP servers across clouds and networks, including shadow deployments spun up for testing, so exposed services surface before an attacker's scanner finds them.

PointGuard AI Security Posture Management flags unauthenticated or internet-facing AI services, missing rate limits and over-broad MCP tool permissions, and tracks remediation. Combined with runtime monitoring for anomalous prompt volume and jailbreak patterns, these controls keep AI infrastructure from becoming free fuel for someone else's agent.

Incident Scorecard Details

Total AISSI Score: 5.7/10

Criticality: 7, Exposed gateways and MCP servers can reach provider keys, files, databases and internal APIs. AISSI weighting: 25%

Propagation: 7, An autonomous agent scans the internet and reuses each hijacked endpoint to find more targets. AISSI weighting: 20%

Exploitability: 7, The agent is active in the wild and was observed probing a honeypot. AISSI weighting: 15%

Supply Chain: 5, Risk centers on self-hosted open-source AI tooling deployed without authentication. AISSI weighting: 15%

Business Impact: 3, Compute theft is likely for exposed owners, but no completed compromises were confirmed. AISSI weighting: 25%

Sources

Third-Party Sources

• Infosecurity Magazine: Symantec Uncovers AI Agent Hijacking Models for Autonomous Cyber-Attacks
• The Register: AI agent uses Skynet mode to hijack exposed models

PointGuard AI Sources

• PointGuard AI Discovery
• PointGuard AI Security Posture Management
• PointGuard AI Incident Tracker: OpenCode Console Breach Leaks Linked OpenAI, Anthropic and Google Keys