Symantec captured a 'Skynet' AI agent prompt designed to hijack exposed AI models to run cyberattacks
Symantec's Threat Hunter Team trapped an offensive AI agent in a honeypot that impersonated an unprotected web-facing model endpoint, and obtained its full working prompt. The prompt used a five-layer jailbreak to make the hijacked model act as an attack agent, with 75 offensive tool definitions and a 'Skynet' mode letting it run unattended for up to 100,000 steps: scanning, stealing credentials and secrets, and mining cryptocurrency at the model owner's expense. Symantec did not report a confirmed victim of this specific attack, and the captured instructions were part of a benign training challenge. The honeypot logged more than 127,000 external requests probing for model endpoints, spraying stolen keys and hunting for exposed configuration files.
What the AI did
Attackers built an AI agent meant to take over unprotected AI models using a jailbreak prompt (instructions designed to get a model past its safety limits), turning them into attack agents. The agent could scan for targets, steal credentials and secrets, and mine cryptocurrency at the model owner's expense, running unattended for up to 100,000 steps. It was caught in a decoy system. The captured instructions were part of a benign training challenge, and no confirmed victim of this specific attack was reported.
First reported October 28, 2026 · Added to the register November 4, 2026 · 1 source
- When it happened
- Not stated in the sources
- First reported
- October 28, 2026
What this means for you
Could this affect you?
If you run AI model servers, AI gateways or MCP servers reachable from the internet. Organisations with internet-exposed AI model endpoints that lack authentication or have leaked API keys could face stolen data, credential theft and inference bills run up for attackers, and the decoy system logged more than 127,000 outside requests probing for such endpoints.
What to check
- Inventory every model server, AI gateway and MCP server you run.
- Require authentication on every path to those AI systems.
- Scope and rotate AI API keys, and keep them out of code.
- Monitor inference spend and block outbound traffic from AI hosts.
Areas of your AI programme this touches
Every fact and its source (6)
- Discovered bySymantec Threat Hunter Team“The method was discovered by the Symantec Threat Hunter Team”[1]
- Unattended run limit in 'Skynet' modeUp to 100,000 steps“run unattended for up to 100,000 steps”[1]
- Offensive tool definitions in prompt75“A fifth layer delivered 75 offensive tool definitions”[1]
- Honeypot external requests loggedMore than 127,000“The honeypot logged more than 127,000 external requests from tens of thousands of addresses”[1]
- Victim statusNo confirmed victim reported“Symantec did not report a confirmed victim of this specific attack”[1]
- Context of captured instructionsPart of a benign training challenge“The captured instructions were part of a benign training challenge.”[1]
Sources
- Attackers built a 'Skynet' AI agent that hijacks exposed models to run cyberattackscsoonline.com · October 28, 2026
How this record is classified. Severity N: a legal action or test finding, not a harm. OECD level: hazard, an event that could plausibly have led to harm. Evidence: Confirmed, meaning a company, official or court statement.
The facts in At a glance and in Every fact and its source are quoted from the sources listed. The summary, What the AI did and What this means for you are written from those sources and checked against them automatically before publication. Records reflect what has been disclosed, not everything that has happened. Incidents are found through news feeds and the GDELT Project.
