Autonomous LLMjacking: 'Skynet' Agent Hijacks Exposed AI Models to Run Attacks
Symantec, Wednesday, October 21st, 2026
Symantec finds an autonomous 'Skynet' agent that hijacks exposed LLMs to run self-directed hacking and cryptomining operations.
Symantec says attackers have built an autonomous offensive agent that hunts the internet for exposed large language models and hijacks them to power a self-directed cybercrime operation.
Once connected to an unprotected model, the agent scans for targets, exploits common web frameworks, steals databases and credentials, and installs cryptocurrency miners.
It can run for up to 100,000 steps without human approval.
The model's owner pays for the compute while compromised servers are stripped of data and used for mining.