Symantec uncovers AI agent for autonomous cyber-attacks with 100,000 actions

Symantec's Threat Hunter Team found an AI agent via an AI honeypot that autonomously runs up to 100,000 malicious actions, including scanning targets, exploiting vulnerabilities, stealing credentials and mining Monero. The agent hijacks exposed LLM endpoints (LLMjacking) and carries about 74 tools for reconnaissance and botnet management.

• The honeypot logged over 127,000 external requests from tens of thousands of unique addresses
• The agent hunts exposed LLM endpoints, AI gateways and MCP servers for free compute
• Its instruction set includes about 74 tools for reconnaissance and data theft
• A Monero-mining script hides itself and erases logs after installation