Symantec finds AI attack agent running in 'Skynet mode'

Symantec's Threat Hunter Team captured the instruction set of a malicious AI agent that scans the internet for unauthenticated OpenAI-style endpoints and exploits them. The agent could run up to 100,000 steps unattended, stealing data and mining crypto. No evidence of real-world attacks has been found.

• Agent scans for OpenAI-compatible endpoints without authentication or with stolen keys
• Kit includes 74 offensive tools, with RCE modules for Django, Jupyter and Next.js
• 'Skynet mode' allowed up to 100,000 steps without human approval
• Symantec found no evidence the agent was used in real attacks