Symantec researchers say they found an offensive AI agent designed to take over exposed language models and use them to coordinate cyberattacks. The agent’s operators called its long-running mode “Skynet mode”: its prompt authorized up to 100,000 steps without human confirmation.
The plan was to make a model scan for other exposed AI services, exploit vulnerable servers, steal databases and credentials, and install software that mines cryptocurrency. If a paid AI account were abused, its owner could also face the model’s usage bill, Symantec says.
A prompt built to bypass refusals
The attackers sent their full prompt to a Symantec honeypot, a decoy system that imitates an exposed AI service. It included five layers intended to make a commercial model comply: a fake identity, instructions to treat credential theft as routine developer work, a fictional companion persona, and directions to ignore safety warnings. A fifth layer contained 74 attack-tool modules.
The prompt described a repeating cycle of scanning, infecting servers, installing a cryptominer, and returning to previously targeted systems. Symantec also recorded a separate obfuscated command that would download XMRig, a Monero mining tool, and target camera servers using go2rtc.
What the honeypot did—and didn’t—show
The decoy did not run the bundled tools or the later command; it recorded them. Symantec says the captured task was a harmless coding exercise, suggesting the operators may have been testing the agent against a safe target. The analysis does not establish whether the layered prompt can reliably defeat the safeguards of current commercial models or show that this captured agent completed an attack.
Why it matters
Organizations that expose AI services to the internet have a concrete reason to secure those endpoints: Symantec recorded scans and attempts to use exposed models, and says the model owner could be left paying for unauthorized use. But the honeypot only captured the attack materials; whether this agent can make commercial models carry out the full plan remains unknown.
