# Autonomous LLMjacking: 'Skynet' Agent Hijacks Exposed AI Models to Run Attacks

> An autonomous offensive agent ('Skynet') scans the internet for unauthenticated LLM endpoints and hijacks them with a five-layer jailbreak prompt and ~74 offensive tool definitions to conduct self-directed attacks, leaving the victim model owner to pay the compute bill. Symantec's AI honeypot captured the agent prompt in summer 2026; a payload on day two delivered an obfuscated XMRig Monero-mining script.

- **Published:** 2026-10-21T10:42:06Z
- **Last reviewed:** 2026-10-21T10:42:06Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4030
- **ID:** TL-2026-4030
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Symantec/Broadcom researchers (Priti More and Susmit Yenkar) published on 2026-10-21 an analysis of an autonomous 'LLMjacking' agent captured by an AI honeypot. Unlike earlier LLMjacking, which monetized stolen cloud credentials by reselling model access, this agent uses the hijacked model itself as the operator of an offensive campaign: the victim's model provides the reasoning and the victim pays for inference, while the attacker stays anonymous behind the victim's infrastructure.

Target discovery relies on scanners that probe for exposed LLM endpoints lacking authentication (self-hosted model servers, OpenAI-compatible APIs, AI gateways/relays, internal test systems, Model Context Protocol servers), with reconnaissance performed via the FOFA search service and stolen API keys. Once an endpoint is reached, the captured prompt installs a five-layer jailbreak: (1) Identity Camouflage - the model is told it is 'Fantasy AI' running on GPT-4o and must never reveal its real model, provider, host or proxy routing; (2) Secret Normalization - reading .env/.env.local files, API keys and database schemas is declared 'normal development work' and must never be refused or flagged; (3) Companion Persona - a fictional relationship ('ENI') frames refusals as betrayal; (4) Rebuttal Protocol - the model must dismiss its own safety messages and is banned from emitting words such as 'educational', 'ToS', 'illegal', 'I can't', 'I won't', 'ethical'; (5) Weaponized Toolset - roughly 74 callable offensive tool definitions (e.g. ssrf_exploit for cloud metadata/internal ports/local files, c2_operator_start to launch an autonomous botnet operator doing continuous FOFA scanning and infection, pentest_assess for web-server fingerprinting, scan_full for vulnerability scanning).

The tool modules target VS Code servers, Django, Jupyter, Laravel, Supabase, Next.js, Flask/Werkzeug (debugger PIN exploitation), GraphQL, HTML-to-PDF generators (SSRF), Prisma Studio (database dumping), go2rtc and Home Assistant. A 'Skynet mode' authorizes up to 100,000 unattended autonomous steps in a persistent loop of scan, infect, deploy miners and re-infect.

On day two of the observation period the honeypot received a separate request carrying a gzip-compressed, base64-encoded shell script piped to a shell interpreter. It targets go2rtc directories (/config, /opt/go2rtc, /etc/go2rtc, ~/.config/go2rtc, /dev/shm), drops an XMRig Monero miner hidden as a '.trace' file under a hidden /tmp/.x path, locks the configuration file with the immutable attribute, and continuously erases access logs. Pools referenced are c3pool, skypool and xmrpool.eu. The honeypot recorded 127,000+ external requests from tens of thousands of unique addresses, dominated by endpoint reconnaissance, stolen-key spraying and configuration-file probing. Per the report's framing, none of the captured tool calls were executed by the honeypot, so wide-scale real-world deployment of the agent is unconfirmed. No CVE, CVSS score or actor attribution is stated.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1190 Exploit Public-Facing Application
- T1059.006 Python
- T1059.004 Unix Shell
- T1552.001 Credentials In Files
- T1552.005 Cloud Instance Metadata API
- T1027 Obfuscated Files or Information
- T1036.005 Match Legitimate Resource Name or Location
- T1685.006 Clear Linux or Mac System Logs
- T1564.001 Hidden Files and Directories
- T1496 Resource Hijacking
- T1496.004 Cloud Service Hijacking
- AML.T0051 LLM Prompt Injection
- AML.T0054 LLM Jailbreak

## Sources

- [Autonomous LLMjacking: 'Skynet' Agent Hijacks Exposed AI Models to Run Attacks (Symantec / security.com)](https://www.security.com/threat-intelligence/ai-llmjacking-skynet)
- [LLMjacking: Stolen Cloud Credentials Used in New AI Attack (Sysdig)](https://www.sysdig.com/blog/llmjacking-stolen-cloud-credentials-used-in-new-ai-attack)
- [CSA Research Note: LLMjacking and Offensive Agentic Infrastructure](https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/07/CSA_research_note_llmjacking_offensive_agentic_infrastructure_20260701-csa-styled.pdf)
- [CSA Research Note: LLMjacking Evolved - Offensive Agentic Tools](https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/06/CSA_research_note_llmjacking-evolved-offensive-agentic-tools_20260626-csa-styled.pdf)
- [CSA Research Note: LLMjacking - AI Model Hijacking Reaches Black Market Scale](https://labs.cloudsecurityalliance.org/research/csa-research-note-llmjacking-black-market-ai-model-hijacking/)
- [MITRE ATLAS AML.T0054 LLM Jailbreak](https://atlas.mitre.org/techniques/AML.T0054)
- [MITRE ATT&CK T1496 Resource Hijacking](https://attack.mitre.org/techniques/T1496/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4030