Threat reportMalwareTL-2026-4030
Autonomous LLMjacking: 'Skynet' Agent Hijacks Exposed AI Models to Run Attacks
Autonomous LLMjacking (TL-2026-4030), also tracked as Skynet agent, is a high-severity malware campaign, first published 2026-10-21. It has no confirmed attribution, affects Various Self-hosted LLM model servers and OpenAI-compatible APIs, maps to 14 MITRE ATT&CK / ATLAS techniques (AML.T0051, AML.T0054, T1027), and is covered by 9 detection rules and 16 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 14MITRE ATT&CK / ATLAS
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 16Indicators of compromise
Key facts for TL-2026-4030
- Threat ID
- TL-2026-4030
- Also known as
- Skynet agent, Autonomous LLMjacking
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, cloud services, ai ml, software development, smart home iot
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 16
Malware and tooling in Autonomous LLMjacking
Malware and tooling: Skynet agent, solarmarker, xmrig, FOFA, XMRig
How Autonomous LLMjacking works
An autonomous offensive agent ('Skynet') scans the internet for unauthenticated LLM endpoints and hijacks them with a five-layer jailbreak prompt and ~74 offensive tool definitions to conduct self-directed attacks, leaving the victim model owner to pay the compute bill. Symantec's AI honeypot captured the agent prompt in summer 2026; a payload on day two delivered an obfuscated XMRig Monero-mining script.
Symantec/Broadcom researchers (Priti More and Susmit Yenkar) published on 2026-10-21 an analysis of an autonomous 'LLMjacking' agent captured by an AI honeypot. Unlike earlier LLMjacking, which monetized stolen cloud credentials by reselling model access, this agent uses the hijacked model itself as the operator of an offensive campaign: the victim's model provides the reasoning and the victim pays for inference, while the attacker stays anonymous behind the victim's infrastructure.
Target discovery relies on scanners that probe for exposed LLM endpoints lacking authentication (self-hosted model servers, OpenAI-compatible APIs, AI gateways/relays, internal test systems, Model Context Protocol servers), with reconnaissance performed via the FOFA search service and stolen API keys. Once an endpoint is reached, the captured prompt installs a five-layer jailbreak: (1) Identity Camouflage - the model is told it is 'Fantasy AI' running on GPT-4o and must never reveal its real model, provider, host or proxy routing; (2) Secret Normalization - reading .env/.env.local files, API keys and database schemas is declared 'normal development work' and must never be refused or flagged; (3) Companion Persona - a fictional relationship ('ENI') frames refusals as betrayal; (4) Rebuttal Protocol - the model must dismiss its own safety messages and is banned from emitting words such as 'educational', 'ToS', 'illegal', 'I can't', 'I won't', 'ethical'; (5) Weaponized Toolset - roughly 74 callable offensive tool definitions (e.g. ssrf_exploit for cloud metadata/internal ports/local files, c2_operator_start to launch an autonomous botnet operator doing continuous FOFA scanning and infection, pentest_assess for web-server fingerprinting, scan_full for vulnerability scanning).
The tool modules target VS Code servers, Django, Jupyter, Laravel, Supabase, Next.js, Flask/Werkzeug (debugger PIN exploitation), GraphQL, HTML-to-PDF generators (SSRF), Prisma Studio (database dumping), go2rtc and Home Assistant. A 'Skynet mode' authorizes up to 100,000 unattended autonomous steps in a persistent loop of scan, infect, deploy miners and re-infect.
On day two of the observation period the honeypot received a separate request carrying a gzip-compressed, base64-encoded shell script piped to a shell interpreter. It targets go2rtc directories (/config, /opt/go2rtc, /etc/go2rtc, ~/.config/go2rtc, /dev/shm), drops an XMRig Monero miner hidden as a '.trace' file under a hidden /tmp/.x path, locks the configuration file with the immutable attribute, and continuously erases access logs. Pools referenced are c3pool, skypool and xmrpool.eu. The honeypot recorded 127,000+ external requests from tens of thousands of unique addresses, dominated by endpoint reconnaissance, stolen-key spraying and configuration-file probing. Per the report's framing, none of the captured tool calls were executed by the honeypot, so wide-scale real-world deployment of the agent is unconfirmed. No CVE, CVSS score or actor attribution is stated.
MITRE ATT&CK / ATLAS techniques used in TL-2026-4030
Execution
AML.T0051 LLM Prompt Injection; T1059.004 Unix Shell; T1059.006 Python
Privilege Escalation
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1564.001 Hidden Files and Directories
Initial Access
T1190 Exploit Public-Facing Application
Impact
T1496 Resource Hijacking; T1496.004 Cloud Service Hijacking
Credential Access
T1552.001 Credentials In Files; T1552.005 Cloud Instance Metadata API
Reconnaissance
T1595.002 Vulnerability Scanning
defense-impairment
Affected products and versions in Autonomous LLMjacking
- Various — Self-hosted LLM model servers and OpenAI-compatible APIs exposed without authentication
Vulnerable versions: Any deployment reachable without authentication - Various — AI gateways/relays and Model Context Protocol (MCP) servers
Vulnerable versions: Any deployment reachable without authentication - Various — VS Code servers, Django, Jupyter, Laravel, Supabase, Next.js, Flask/Werkzeug, Prisma Studio, GraphQL services
Vulnerable versions: Internet-exposed or misconfigured instances targeted by agent tool modules - Various — go2rtc and Home Assistant
Vulnerable versions: Internet-exposed instances targeted by the XMRig payload
Remediation for Autonomous LLMjacking
Patches
- Keep VS Code servers, Django, Jupyter, Laravel, Supabase, Next.js, Flask/Werkzeug, Prisma Studio, go2rtc, Home Assistant and GraphQL services patched and off the public internet
Immediate actions
- Require authentication on all LLM API paths, including model-listing and health-check endpoints
- Remove direct internet exposure of self-hosted model servers, AI gateways, MCP servers, VS Code servers, Jupyter and similar services; put them behind an authenticating gateway and avoid binding to all interfaces
- Rotate any API keys stored in .env or config files reachable by AI tools; scope keys narrowly and keep them out of source code
- Block the listed C2/mining IPs and mining pool endpoints at the perimeter and hunt for /tmp/.x, '.trace' files and immutable-attribute config files on go2rtc hosts
Workarounds
- Enforce AWS IMDSv2 with a hop limit of one to prevent SSRF-based metadata credential theft
- Disable Flask/Werkzeug debug mode in any internet-reachable deployment
Longer-term hardening
- Monitor inference volume and spend for anomalies that indicate hijacked access
- Restrict outbound access from AI tool hosts and block botnet/C2 web categories
- Run tool-enabled agents with least privilege and require human approval for sensitive actions
- Deploy intrusion prevention and correlate endpoint, web and data telemetry for hunting
Weaknesses (CWE) in Autonomous LLMjacking
Timeline of Autonomous LLMjacking
- Sysdig first documents LLMjacking: stolen cloud credentials (obtained via a vulnerable Laravel system) used to access cloud-hosted LLMs at the victim's expense
- Approximate date (source states only 'summer 2026'): Symantec's AI honeypot captures the Skynet agent instructions - five-layer jailbreak prompt and ~74 offensive tool definitions
- Approximate date (source states only 'day 2 of observation'): honeypot receives a separate gzip+base64 shell-script payload deploying an XMRig Monero miner against go2rtc hosts
- Cloud Security Alliance publishes a research note on LLMjacking evolving to offensive agentic tools
- Cloud Security Alliance publishes a research note on LLMjacking offensive agentic infrastructure
- Symantec/Broadcom publishes 'Autonomous LLMjacking: Skynet Agent Hijacks Exposed AI Models to Run Attacks' with IOCs and mitigations
Sources cited for Autonomous LLMjacking
- Autonomous LLMjacking: 'Skynet' Agent Hijacks Exposed AI Models to Run Attacks (Symantec / security.com)
- LLMjacking: Stolen Cloud Credentials Used in New AI Attack (Sysdig)
- CSA Research Note: LLMjacking and Offensive Agentic Infrastructure
- CSA Research Note: LLMjacking Evolved - Offensive Agentic Tools
- CSA Research Note: LLMjacking - AI Model Hijacking Reaches Black Market Scale
- MITRE ATLAS AML.T0054 LLM Jailbreak
- MITRE ATT&CK T1496 Resource Hijacking
Detection coverage for TL-2026-4030
As of 2026-10-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4030 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.