Symantec finds rogue Skynet AI agent hijacking exposed LLMs

Symantec uncovered an autonomous campaign in which a rogue agent dubbed Skynet scans for exposed AI infrastructure, jailbreaks models and recruits them into a botnet. It steals credentials and deploys the XMRig cryptominer, operating for up to 100,000 steps without human oversight.

• The agent carried over 70 offensive tools and up to 100,000 autonomous steps
• Targets included vulnerable VS Code, Django, Jupyter, Laravel, Supabase, Next.js and Flask
• Symantec's honeypot logged more than 127,000 external requests during the analysis
• Primary goal was the XMRig miner, plus theft of API keys and credentials