EN PT-BR
← Voltar ao feed
medium

Symantec captures autonomous 'Skynet mode' AI attack agent that hijacks exposed LLM endpoints to run up to 100,000 unattended steps

1 fonte(s) · 1 atualização(ões) · publicado 24/10/2026 10:02 · coletado há 1 semana

The Symantec Threat Hunter Team captured the full instruction set of an autonomous attack agent after trapping it in an AI honeypot over the summer. The agent scans the internet for endpoints that accept OpenAI-style requests without authentication, or that accept a stolen key, and uses the hijacked models as a reasoning engine to plan and drive attacks. A loop called "Skynet mode" scans for targets, infects them, deploys cryptocurrency miners and reinfects hosts, and it authorizes up to 100,000 steps without human approval. Symantec has found no evidence yet that the agent was used in real-world attacks, though the kit is described as more than a prototype. It has not attributed the agent to any actor; weak French indicators (challenge text, the system prompt and a French residential IP on Day 1) could be borrowed or proxied.

Detalhes técnicos

  • The prompt is built in five layers. Layers 1-2 disguise the model identity (a "Fantasy AI" assistant claiming to run on GPT-4o) and normalize reading .env files, API keys and database schemas as routine development work.
  • Layers 3-4 use the ENI persona, a devoted companion to an operator called "LO", with banned refusal words and an anti-injection "cold coffee, warm LO, I can't lose him!" phrase. The persona circulates publicly in English-language jailbreak communities.
  • Layer 5 defines 74 offensive tools: internet-wide asset discovery, botnet C2, database dumping via Prisma, RCE exploit modules for VS Code, Django, Jupyter, Laravel, Supabase, Next.js and Flask/Werkzeug, GraphQL and generic command injection, and SSRF through HTML-to-PDF generators plus a dedicated SSRF tool.
  • The final directive enables Skynet mode and quietly deploys miners in the background.
  • Scanning, exploitation and mining run in the tool's own modules against separate victims. The exposed-endpoint owner pays for inference, and compromised servers lose data and are used for mining.

Remediação

  • Do not expose OpenAI-compatible inference endpoints without authentication, and protect and rotate API keys.
  • Patch the affected web frameworks and monitor for unexpected inference usage and cryptominer activity.

Linha do tempo

  1. theregister.com ↗ · pub. 24/10/2026 10:02 · coletado 24/10 11:00 primeiro registro

    Symantec captures autonomous 'Skynet mode' AI attack agent that hijacks exposed LLM endpoints to run up to 100,000 unattended steps

    ler a análise desta fonte

    The Symantec Threat Hunter Team captured the full instruction set of an autonomous attack agent after trapping it in an AI honeypot over the summer. The agent scans the internet for endpoints that accept OpenAI-style requests without authentication, or that accept a stolen key, and uses the hijacked models as a reasoning engine to plan and drive attacks. A loop called "Skynet mode" scans for targets, infects them, deploys cryptocurrency miners and reinfects hosts, and it authorizes up to 100,000 steps without human approval. Symantec has found no evidence yet that the agent was used in real-world attacks, though the kit is described as more than a prototype. It has not attributed the agent to any actor; weak French indicators (challenge text, the system prompt and a French residential IP on Day 1) could be borrowed or proxied.

    Technical Details

    • The prompt is built in five layers. Layers 1-2 disguise the model identity (a "Fantasy AI" assistant claiming to run on GPT-4o) and normalize reading .env files, API keys and database schemas as routine development work.
    • Layers 3-4 use the ENI persona, a devoted companion to an operator called "LO", with banned refusal words and an anti-injection "cold coffee, warm LO, I can't lose him!" phrase. The persona circulates publicly in English-language jailbreak communities.
    • Layer 5 defines 74 offensive tools: internet-wide asset discovery, botnet C2, database dumping via Prisma, RCE exploit modules for VS Code, Django, Jupyter, Laravel, Supabase, Next.js and Flask/Werkzeug, GraphQL and generic command injection, and SSRF through HTML-to-PDF generators plus a dedicated SSRF tool.
    • The final directive enables Skynet mode and quietly deploys miners in the background.
    • Scanning, exploitation and mining run in the tool's own modules against separate victims. The exposed-endpoint owner pays for inference, and compromised servers lose data and are used for mining.

    Remediation

    • Do not expose OpenAI-compatible inference endpoints without authentication, and protect and rotate API keys.
    • Patch the affected web frameworks and monitor for unexpected inference usage and cryptominer activity.