Symantec Says Its Decoy AI Server Caught an Attack Tool That Runs Itself
Symantec said a decoy system it runs to impersonate an unprotected AI service on the internet captured the complete working prompt of an attack tool built to hijack other people's AI models and run on its own. The capture happened in the summer of 2026, and the company published its account of it Oct. 21, 2026.
The activity is a form of what the security industry calls LLMjacking: stealing access to somebody else's AI model so that the victim pays for the computing. Symantec's report says what sets this tool apart is that the hijacked model does not simply answer questions. It plans and drives the attack, while the tool's own modules do the scanning, the break-ins and the mining.
Symantec says the captured instructions told the agent to run unattended for up to 100,000 steps and to execute its tools without waiting for human approval, under a directive the operators themselves called "Skynet mode." The company counted about 74 callable offensive tool definitions in the request, covering internet-wide scanning, theft of databases, harvesting of credentials and secrets, and cryptocurrency mining.
Symantec says its decoy recorded more than 127,000 external requests from tens of thousands of unique addresses over the period, most of them reconnaissance of AI services and probing with stolen keys. The report adds that the decoy ran none of the tool calls in the captured request and that a second request the next day carried a hidden command to install cryptocurrency-mining software, which it also captured without running.
The company's own assessment is that the individual techniques are not new, and that what stands out is their assembly into a single self-directed agent, which it says lowers the skill needed to run a broad campaign. Every figure here is Symantec's own, measured by its own decoy.
Its advice is about setup rather than malware: require authentication on every path to a model server, an AI gateway or an MCP server that links a model to other software, treat AI API keys as high-value credentials, and restrict outbound network access from systems that run tool-enabled agents.
