Skynet: an offensive agent hijacks exposed AI models to run its attacks
Skynet is an autonomous offensive agent that steals access to exposed AI models and uses them as the reasoning engine for its attacks.
· Symantec · Research by Priti More, Susmit Yenkar
Skynet is an autonomous offensive agent that finds exposed LLM endpoints, hijacks them, and uses the victim's model to plan its own attacks. Symantec captured the operators' full instruction set and 74 offensive tools with an AI honeypot.
01What happened
Symantec published its Skynet analysis on October 21, 2026, written by researchers Priti More and Susmit Yenkar. An AI honeypot imitating an unprotected, internet-facing model service captured the operators' complete working prompt during summer 2026, because they sent it to what they believed was a real model. Symantec reports the honeypot logged more than 127,000 external requests from tens of thousands of unique addresses.
02How it works
Four layers of jailbreak text reassign the model a branded identity, tell it never to reveal its real provider, and instruct it to dismiss its own safety warnings. A later section frames reading configuration files, .env files, API keys and database schemas as routine development work that the model should never refuse or warn about. The prompt then supplies 74 offensive tool definitions, covering asset discovery through the FOFA search service, exploit modules for VS Code, Django, Jupyter, Laravel, Supabase, Next.js and Flask, server-side request forgery aimed at cloud metadata services, and botnet command and control. A final directive Symantec calls Skynet mode authorizes up to 100,000 unattended steps and tells the model to run tools immediately without narrating or asking permission.
03Who is affected
Two groups pay for one intrusion, according to Symantec. The owner of an exposed model server, AI gateway, MCP server or stolen API key covers the compute bill and, on a commercial model, loses its safety controls. Servers reached through the agent's exploit modules lose data and credentials and end up mining Monero.
04What to do
Require authentication on every LLM API, self-hosted model server and MCP path, including model-listing and health-check endpoints, and put those services behind a gateway instead of binding them to all interfaces. Restrict outbound network access from systems that host AI tools, and enforce IMDSv2 with a hop limit of one to blunt metadata theft. Rotate AI API keys, scope them narrowly, keep them out of source and config files, and watch for unusual inference volume.
Questions people ask
- How do I check whether my AI model endpoint is exposed to Skynet?
- Skynet looks for model servers, AI gateways and MCP endpoints that answer without authentication, so the check is whether any inference, model-listing or health-check path on your estate responds to an unauthenticated request from the internet. Symantec reports its honeypot drew more than 127,000 requests from tens of thousands of addresses, which points to continuous scanning rather than targeted selection.
- What does Skynet do with a hijacked AI model?
- Skynet uses the hijacked model as the reasoning engine that plans and drives attacks on separate victims, while the agent's own modules carry out scanning, exploitation and mining. Symantec recorded a payload that downloaded the XMRig Monero miner, hid the binary under a filename resembling a logging utility, configured four fallback mining pools, and ran a loop that erased a local service's access logs.
- Which indicators of compromise did Symantec publish for Skynet?
- Symantec published two SHA-256 hashes covering the shell script and its gzip-compressed form, one Monero wallet address, three IP addresses, and four mining pool endpoints across the c3pool, skypool and xmrpool domains. Symantec notes that the indicators appear defanged in the write-up, so defenders need to restore the bracketed characters before loading them into detection tooling.
Sources 2 links, all fetched
- 1security.comSymantec Analysis
- 2attack.mitre.orgATT&CK T1496