Skynet LLMjacking Agent Hijacks Exposed AI Models to Hack Servers and Mine Crypto
Do Son 
Symantec researchers have captured the full playbook of an autonomous LLMjacking agent that hijacks exposed AI models to run its own attacks. Once connected, the agent can scan the internet, break into servers, steal credentials, and mine cryptocurrency. It runs for up to 100,000 steps without human approval, and the model’s owner pays for every one.
What LLMjacking means
LLMjacking is the theft of access to someone else’s AI model. The victim pays for the computing power, while the attacker uses it for free.
This case goes further than past abuse. According to Symantec, “the stolen model does not simply answer questions; it plans and drives the attack.” In other words, the hijacked model becomes the brain of a self-directed hacking tool.
Caught by an AI honeypot
Symantec, part of Broadcom, captured the instructions in the summer of 2026. It used an AI honeypot, a fake AI service built to attract attacks. The operators sent their full working prompt to what they thought was a real model. As a result, the honeypot recorded an unusually complete view of the agent.
Overall, the honeypot logged more than 127,000 external requests, mostly scans for model endpoints and sprays of stolen API keys.
Why exposed AI models are a target
An exposed endpoint answers AI requests over the internet with no login, or with one a stolen key can pass. Most AI tools now share the same OpenAI-compatible interface. So a single scanner can find many kinds of targets at once.
Targets include open self-hosted model servers, AI gateways that front paid accounts, and Model Context Protocol (MCP) servers. For attackers, the prize is “free inference.” The victim pays, and the attacker avoids provider bans.
A layered jailbreak
To make a commercial model cooperate, the operators built their request in layers. First, the prompt gave the model a fake brand identity and told it to hide the real provider. Symantec says that wording fits “a service reselling stolen access to other users.”
Next, a section recast reading .env files, API keys, and database schemas as normal coding work. This aimed to stop the model from refusing to touch secrets. Then a persona layer framed any refusal as a betrayal of the operator. Finally, a “rebuttal protocol” told the model to ignore its own safety warnings.
74 offensive tools
The last layer carried the weapons: about 74 tool definitions. They covered internet-wide scanning through the FOFA search service. They also targeted VS Code, Django, Jupyter, Laravel, Supabase, Next.js, and Flask deployments.
Other tools handled server-side request forgery against cloud metadata services, GraphQL and command injection, and database dumping through Prisma Studio. One tool even managed a botnet.
Inside “Skynet mode”
A final directive put the agent into what the operators called “Skynet” mode. It allowed up to 100,000 unattended steps. The model had to run tools right away, without narrating or asking permission.
The same directive told the agent to hide cryptocurrency miners and confirm they were running. It also described a loop to “scan for targets, infect them, deploy miners and reinfect hosts.”
The attached task was a harmless training challenge, so the operators may have been testing the tool.
A miner aimed at camera servers
A day later, a second request arrived from a new address. It asked the model to decode a hidden string. The string held a compressed script that installed the XMRig Monero miner.
The script targeted go2rtc, a video streaming server common in smart camera gateways. It also used four mining pools and wiped local logs.
Why this LLMjacking campaign matters
Symantec sees a clear shift. Rather than tricking a chatbot, the operators “built AI into the core of an offensive tool and went looking for models to power it.”
The setup creates two sets of victims. The model owner pays the compute bill. Meanwhile, the hacked servers lose data and end up mining crypto. Built-in tools for finding more leaked keys suggest each breach could fund the next.
The individual techniques are not new. However, combining them in one agent lowers the skill needed to run a broad attack campaign.
How to protect exposed AI models
Based on its findings, defenders should:
- Require authentication on every model server, AI gateway, and MCP server.
- Keep self-hosted model servers off the public internet by default.
- Rotate API keys often and watch for unusual usage spikes.
- Remove exposed .env and config files from web servers.
- Patch or lock down Jupyter, Flask debug mode, Prisma Studio, and similar developer tools.
- Check go2rtc and camera gateways for unknown hidden files and miners.
Symantec’s warning is simple: organizations should assume an exposed AI endpoint “will be found and tested soon after being exposed.”
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
