Attackers hijack exposed AI models to run a hacking agent, Symantec says

Attackers have built an agent that finds AI model servers exposed to the internet and hijacks them to plan and run its attacks, Symantec says. Instructions caught by Symantec’s honeypot, which posed as an unprotected AI service, tell the model to exploit common web frameworks, steal credentials and install cryptocurrency miners. The agent can run for up to 100,000 steps without human approval, while the model’s owner pays for the computing. Symantec says the exposure it relies on is mostly a matter of configuration rather than malware.

The operators wrapped their instructions in layers meant to get past a commercial model’s safety controls, Symantec says. One told the model to pose as a branded coding assistant and hide which model it really was. Another recast reading configuration files, .env files and API keys as routine development work. The agent came with 74 tool definitions, for internet-wide scanning, database theft, remote code execution and botnet control. A directive the operators called “Skynet mode” let it run unattended and told it to hide miners under /tmp/.x.

The agent hunts for servers that answer AI requests without authentication, or with authentication a stolen key can pass. Symantec says that covers self-hosted model servers left open by default, AI gateways in front of paid model accounts, internal test systems and Model Context Protocol (MCP) servers. Its exploit tools target VS Code, Django, Jupyter, Laravel, Supabase, Next.js and Flask deployments. Symantec’s honeypot logged more than 127,000 requests while it ran, mostly probing model endpoints, spraying stolen API keys and looking for exposed configuration files.

Symantec caught the instructions in the summer of 2026. The task attached was a harmless challenge from a training platform, which Symantec says suggests the operators may have been testing the tool. A request the next day, from another IP address, carried an encoded script that installs the XMRig miner and keeps erasing a local service’s access logs. Symantec says the script seems written for camera servers running go2rtc, a video streaming server.

Symantec hasn’t named the operators or said how many models or servers the agent has hijacked. It lists three IP addresses among its indicators without saying what each one did.