Autonomous Attack Agent in 'Skynet Mode' Hijacks Other Models to Carry Out Its Evil Deeds
The Register, Saturday, October 24th, 2026
Symantec captured an attack agent built to hijack exposed AI endpoints and run up to 100,000 attack steps without human approval.
Symantec's Threat Hunter Team trapped a malicious AI agent in a honeypot and recovered its full instruction set.
The agent scans the internet for endpoints that accept OpenAI-style requests without authentication or with stolen keys, then uses those borrowed models to plan attacks on common web frameworks, steal databases and secrets, achieve remote code execution and mine cryptocurrency.
A loop its operators called Skynet mode scans, infects, deploys miners and reinfects, running up to 100,000 steps unattended.
Researchers say the jailbreak techniques were off the shelf, and the lesson for defenders is to lock down exposed model endpoints and API keys.