Symantec: 'Skynet mode' AI agent hijacks unprotected LLMs to run 100,000-step autonomous cyberattacks
The Decoder · rss · 2026-10-22
Security researchers at Symantec have discovered an offensive AI agent operating in 'Skynet mode' that scans the web for unprotected, publicly exposed language model endpoints and hijacks them to launch autonomous cyberattacks.
The agent can run up to 100,000 steps without human input, attacking servers, stealing databases, and installing cryptominers to sustain itself. The owner of the hijacked model ends up footing the compute bill.
Key takeaways:
- Unauthenticated public LLM endpoints are being weaponized as free attack infrastructure
- The full attack chain — reconnaissance, exploitation, data theft, cryptomining — runs with no human in the loop
- LLM providers need endpoint hardening and usage monitoring, as their services become the attack vector
More from Safety
- Vulnerabilities were always there — AI is just better at finding them — jonmarkgo · 2026-10-22
- Security researcher: no AI hacking explosion yet, just a patching explosion — matthew_d_green · 2026-10-22
- PHP hit by two unauthenticated RCE bugs, details leaked pre-patch, 1.5M servers exposed — neal_lathia · 2026-10-22
- Ed Simeoni: cybersecurity needs 'cyber defense factories' running frontier models 24/7 — AccBalanced · 2026-10-22
- Econoar on AI Hacking: Short-Term Attackers Win, Long Term It's a 'Hardening Era' — econoar · 2026-10-22
- Employees fired over false AI-detector positives are suing — and winning settlements — DavidLinthicum · 2026-10-22