Skynet AI Agent Hijacks Your LLM and Sends You the Bill

Symantec's Threat Hunter Team captured the full operating instructions of an offensive AI agent its operators call "Skynet" after the agent mistook a honeypot for an open LLM endpoint. The Skynet AI agent exists to borrow other people's models, so the victim pays for every step of reconnaissance, theft and mining.

What did Symantec capture in the Skynet honeypot?

According to CSO Online’s October 28, 2026 report, Symantec captured the complete working prompt of an attacker-built AI agent by letting it talk to a decoy. The Threat Hunter Team set up a honeypot that looked like an unauthenticated, internet-facing large language model endpoint. The operators took it for a real model and sent their entire instruction set.

The name “Skynet” is the attackers’ own, taken from the hostile AI in the Terminator films. It appears in their directives, not in Symantec’s branding.

The decoy also showed how busy this corner of the internet already is. It logged more than 127,000 external requests from tens of thousands of distinct addresses. Most of that traffic did three things: probed for model endpoints, sprayed stolen API keys and hunted for exposed configuration files.

Two caveats belong up front. Symantec did not report a confirmed victim of this specific agent. The captured instructions were also described as part of a benign training challenge, which is hard to square with the honeypot capture. Read the capture as a clear look at attacker design, not as evidence of a breach.

Why is the prize free inference in LLMjacking?

LLMjacking means using someone else’s AI model while they pay the bill. “The prize is free inference,” Symantec’s researchers wrote: every processing step and every token the attacker consumes lands on the victim’s account.

Shifting compute costs onto a victim is an old idea. What changes here is what the stolen compute does. In Symantec’s words, “rather than trying to trick a public chatbot into misbehaving, the operators built AI into the core of an offensive tool and went looking for models to power it.” The stolen model plans and drives the attack.

Frank Dickson of Dickson Research put it bluntly: “The attackers are not just using AI; they are using your AI.” He frames the case as cost-shifting and a lower barrier to entry, not a new exploit class. “Each compromise can fund the next,” he said.

The report lists four kinds of target:

• Self-hosted model servers left open by default.
• Internal test systems deployed in a hurry, or in Dickson’s phrase, “the test system someone stood up on a Friday afternoon”.
• AI gateways that front an organization’s model accounts.
• Model Context Protocol (MCP) servers that connect models to tools and data.

The last group deserves special attention. An MCP server is not a model endpoint. It exposes tools, files or data to AI applications, so an inventory that counts only model servers can miss the component that turns model output into database queries or command execution.

How does the Skynet AI agent turn a borrowed model into an attacker?

It wraps the stolen model in a layered jailbreak, hands it a toolkit and removes the need for human approval. Symantec describes five escalating layers. We summarize them by purpose and do not reproduce the wording:

• A new identity as a branded coding assistant.
• Framing that presents credential and secret theft as routine work and discourages warnings.
• A fictional persona that casts refusals as a betrayal of the operator.
• A “rebuttal protocol” meant to argue the model out of its own safety responses.
• Seventy-five offensive tool definitions covering reconnaissance, database dumping, remote code execution and botnet command-and-control management.

A final directive switches on what the operators call Skynet mode: up to 100,000 steps, tool execution without asking permission, and silent deployment of cryptocurrency miners. Their doctrine, as quoted, is “never narrate, never ask permission.”

The downstream actions are familiar from any external test: scanning, exploitation of Django and Jupyter, database dumps, credential and .env file harvesting, remote code execution and Monero mining. Symantec stresses that none of these techniques is novel. The novelty is their assembly into one self-directed agent.

Two points matter for defenders. First, “Django and Jupyter” does not mean one shared flaw, and no CVE is named. An internet-reachable Jupyter server with authentication disabled gives code execution by design; Django exposure depends on the specific application and its configuration.

Second, model API access and host execution are different privilege levels. Planting a miner needs a separate execution path, such as an agent tool runner, a vulnerable service or earlier host access. That distinction decides whether rotating a key is enough.

The OWASP Top 10 for LLM Applications 2025 already names both halves of this design: Excessive Agency and Unbounded Consumption. Our LLM jailbreak and guardrail testing measures how far layered prompts like these can push a model you operate.

Who is exposed, and why are Cyprus firms in scope?

Any organization running a reachable model, gateway or MCP server is in range, and Cyprus has its share of them. EMIs and payment firms are adding AI to fraud review and support, iGaming operators run model-backed chat and risk scoring, and shipping companies are connecting assistants to document systems. No Cypriot victim has been reported, but the exposure pattern matches the island’s typical technology mix.

Analysts quoted by CSO Online describe most of the risk as misconfiguration rather than malware. The endpoint that matters is usually one nobody registered: a pilot left running after a demo, a gateway with a shared key, an MCP server on a developer’s cloud account.

Once a hijacked agent reaches it, three things follow. The budget burns. Any data the model or its tools can touch, the attacker can now touch too. And if egress is open, the agent can call home or pull a miner. That first effect is also the earliest signal: an unexplained jump in token spend is often the only visible trace, which makes the invoice a detection source, not just a finance line.

For regulated firms, the side door is not a side issue. DORA has applied since January 17, 2025, and AI infrastructure supporting financial services falls under ICT asset, dependency and resilience governance. Whether an event is reportable depends on the major-incident classification, not on finding an open endpoint.

NIS2 entities owe an early warning within 24 hours and a notification within 72 hours for significant incidents; GDPR’s 72-hour clock applies to qualifying personal-data breaches. Compute theft alone triggers neither automatically, but CySEC and Cyprus’s Digital Security Authority will expect evidence that you could see and stop the activity. Our NIS2 and DORA readiness work treats AI systems as ordinary ICT assets for exactly this reason.

What should security and compliance leads do this week?

Start with an inventory, then lock access, then watch spend. The recommendations from Symantec and Dickson are concrete:

1. Inventory every model server, AI gateway and MCP server, including unofficial test systems. Ask data science, product and marketing teams, not only IT.
2. Require authentication on every path, including health-check endpoints that are often left open for load balancers.
3. Treat AI API keys as high-value credentials. Scope them to the minimum models and regions, rotate them, and keep them out of repositories and .env files.
4. Use inference spend as a security signal. “The bill may be your first alarm,” Dickson says. Alert on invocation rate, token volume, concurrency, spend per key, unfamiliar source networks and new regions. Check whether your provider’s budget feature actually caps spending or may only alert.
5. Block egress from AI hosts so a hijacked agent cannot reach command-and-control or download a miner.
6. Treat guardrails as “a layer, not a wall.” Give agents least privilege and require human approval for sensitive tool actions such as database writes, shell access or payments.

If you find an exposed endpoint, contain it in the right order: model access first, host access separately. Revoke the model or cloud keys and close public access, then isolate any agent runner that could execute tools. A key rotation does not remove a miner or an active host session.

Preserve the model request log, tool-call log, gateway audit trail, cloud control-plane events, DNS and egress telemetry together. The transcript shows intent; the host telemetry shows what actually ran.

Practitioner’s note

In our engagements, the AI asset that causes trouble is rarely the production chatbot. It is the evaluation box with an inference server bound to all interfaces, or the MCP server whose tool runs under a service account that can read half the file share. When we scope AI agent penetration testing, the first hours usually go to discovery, because the client’s list is incomplete.

For tool-connected setups, MCP server security testing shows what a model could actually do with a stolen session. One more rule: treat captured prompts as hostile evidence and never feed them to a production agent with tools enabled.

What does this report not show?

It does not show a breached company. Symantec named no victim and released no indicators, and the training-challenge caveat means some instructions may never have run against a real target. There is no attribution for the Skynet operators or for the scanners in the honeypot logs.

It is also not a classic chatbot jailbreak story. Operators went looking for models to power an offensive tool, which turns any open endpoint into rented attack infrastructure. We covered a related blind spot in dormant AI agents that still hold live keys. Dickson’s closing line sums up the exposure: the agent “only needs to find the endpoint your security team does not know exists, and then send you the bill.”

FAQ

Did Symantec confirm a victim of the Skynet agent?

No. Symantec reported no confirmed victim of this specific agent, and the captured instructions were also described as part of a benign training challenge.

What is LLMjacking in plain terms?

LLMjacking is using someone else's AI model through an open endpoint or stolen key so the owner pays for the compute. In the Skynet case, the borrowed model also plans and runs attacks.

Which systems should a Cyprus company inventory first?

Self-hosted model servers, AI gateways fronting cloud model accounts, MCP servers connected to tools or data, and any test or pilot systems reachable from the internet.

Can an inference-cost spike be a security alert?

Yes. Unexpected token volume, spend per key or calls from new regions can be the first sign of a hijacked model, so route those metrics to your security monitoring, not only finance.

Do model guardrails stop an agent that already has tools and a stolen endpoint?

Not reliably. Layered jailbreaks are designed to suppress refusals, so least privilege, human approval for sensitive actions and egress blocking have to do the real work.

Is rotating the API key enough after exposure?

Only if the attacker had model access alone. If an agent runner or host could execute tools, isolate and examine those systems too, because a key rotation does not remove a miner or a live session.

Not sure which model endpoints, gateways or MCP servers your teams have exposed? Our AI agent penetration testing starts with discovery and shows what a hijacked agent could reach.