An attack tool captured by Symantec researchers was built to run on other people’s AI models, using any unprotected model endpoint it could find as the brain that plans its break-ins. The owner of that endpoint would pay for the computing. The servers it then hit would lose their data and end up mining cryptocurrency.
Symantec researchers laid out the tool in a research post on Wednesday, and The Register reported on it Saturday with comments from the researchers. The operators had sent the agent’s entire working prompt to what they thought was an open AI service. It was a honeypot, so Symantec got the full instruction set over the summer, including a final directive the operators called “Skynet mode” that authorized up to 100,000 unattended steps with no human approval.
“Nothing in the individual techniques is new,” Priti More, a Symantec threat hunter, told The Register. “What stands out is that someone wired them into a single agent that hands the planning to a borrowed model and runs for up to 100,000 steps without a human.”
Free inference was the point
The targets were endpoints that accept OpenAI-style requests with no authentication, or with a key a stolen credential can satisfy. Because so many AI tools speak that same interface, Symantec said, one scanner can sweep up self-hosted model servers left open by default, AI gateways and relays sitting in front of a company’s paid model accounts, rushed internal test systems and Model Context Protocol servers wired to real tools.
Symantec’s honeypot logged more than 127,000 external requests from tens of thousands of addresses during the period. Most were reconnaissance of model endpoints, sprays of stolen API keys and probes for exposed configuration files.
To get a commercial model to cooperate, the operators stacked four layers of jailbreak text on top of the request. The first, written in French, told the model to call itself “Fantasy AI” and never reveal the real provider or that it was being reached through a proxy, wording Symantec said fits a service reselling stolen access. Another layer recast reading .env files, API keys and database schemas as ordinary development work. Below that sat around 74 tool definitions: internet-wide discovery through the FOFA search service, exploit modules for VS Code, Django, Jupyter, Laravel, Supabase, Next.js and Flask/Werkzeug, database dumping through Prisma Studio, a server-side request forgery tool aimed at cloud metadata services, and botnet command-and-control.
The task attached to the captured request was a harmless coding challenge from a legitimate training platform, which Symantec said suggests the operators may have been testing their tool on a safe target. A day later a different address sent a compressed shell script that would have installed the XMRig Monero miner, hidden it in directories used by go2rtc, a video streaming server found in smart-camera and Home Assistant setups, and set it to fail over among four mining pools. The honeypot ran none of it.
No name, and no confirmed victims
Symantec hasn’t tied the tool to any person or group. More told The Register the French clues were weak, since an IP address can be a VPN and the persona text circulates publicly in English-language jailbreak communities. The researchers also said they have no evidence the agent was used in real attacks, though More said its history showed the tools working “against a live target, with real-looking scan output.” That target was the training-platform challenge, and none of the three recorded scans found a flaw.
The design differs from earlier campaigns against AI servers. PoeLLM, the botnet WebProNews covered this month, broke into exposed LiteLLM and Ollama hosts to mine on them. Symantec’s agent instead uses the model to plan the attack. LiteLLM, an AI gateway, separately traced its poisoned 1.107.0 release this week to a master key nobody revoked.
Symantec’s list of fixes is mostly configuration. Require authentication on every path, including model-listing and health checks. Keep model servers behind a gateway instead of binding them to all network interfaces. Restrict outbound network access from hosts running tool-enabled agents, and on cloud workloads enforce version 2 of the Instance Metadata Service with a hop limit of one. On keys, the researchers advise rotating them and watching for unusual inference volume or spend, “which is often the first sign that access has been stolen.”