Symantec's Threat Hunter Team has documented an AI agent built to conduct an entire intrusion chain without a human operator, using hijacked or unpaid-for model access to drive as many as 100,000 malicious actions. The agent was observed through an AI honeypot that masqueraded as an exposed, unsecured AI service, and its complete instruction set was recovered during summer 2026, with the findings published on October 21. The toolkit covers roughly 74 capabilities, from internet-wide scanning and web framework exploitation to credential harvesting and botnet management, plus an obfuscated Monero miner. Individually the techniques are familiar; packaged into one autonomous loop, they lower the bar for running broad exploitation campaigns.

How the agent was caught

Rather than hunting for the tooling in the wild, the researchers deployed a decoy: an internet-facing AI service designed to look unprotected and worth abusing. Because the honeypot only pretended to offer inference capacity, it never actually ran the attacker's payloads — a containment choice that let Symantec observe intent without enabling exploitation.

The decoy proved attractive. Between its deployment and the publication of the report, it logged more than 127,000 external requests originating from tens of thousands of distinct addresses. Within that traffic sat the agent's full instruction set, which the team characterized as evidence of a deliberate design for unattended operation rather than a one-off script.

LLMjacking: shifting inference costs onto victims

A central objective of the agent is to locate reachable endpoints belonging to large language models — self-hosted deployments, AI gateways, and model context protocol (MCP) servers — and to consume their capacity. Symantec frames this as the agent hunting for someone else's compute to run its reasoning loop for free, a practice sometimes labelled LLMjacking.

The economics explain the appeal. Every inference call costs somebody: either CPU or GPU time on a self-hosted box, or per-token charges on a commercial API. By pushing its work through a stranger's endpoint or a stolen API key, the operator transfers that bill to the victim. The arrangement has a secondary benefit — the traffic originates from infrastructure the attacker does not own and does not have to defend, which provides cover and sidesteps the suspensions that model providers impose on abusive accounts.

Inside the instruction set

The recovered instructions describe a modular system with about 74 distinct tools. Their functions cluster into recognizable attack phases:

• Reconnaissance at internet scale, enumerating exposed services rather than targeting a predefined list.
• Exploitation of widely deployed web frameworks, focusing on common, well-understood weaknesses.
• Data theft, including database extraction and credential harvesting.
• Botnet control, giving the operator persistence and a pool of hosts to reuse.

Notably, the agent's prompts were layered specifically to defeat the guardrails of commercial models. One technique reframes credential theft as ordinary software development work, attempting to make a request that would normally be refused appear benign. Elsewhere in the captured traffic, a separate request carried an obfuscated script built to install Monero mining software, hide its presence on the host, and clear logs afterward — a combination aimed at extending dwell time and complicating forensic reconstruction.

Why one agent matters more than its parts

Symantec was explicit that none of the underlying techniques are new. What changes is the packaging. The researchers described the model as the reasoning engine that plans and drives the campaign, while the surrounding modules perform scanning, exploitation, and mining against separate victims. In their assessment, an operator can simply hand the model a goal and let it work.

That division of labour is what shifts the skill requirement. Tasks that previously demanded a human to interpret scan output, choose an exploit, and adapt when it failed can now be delegated to a system that iterates on its own. Symantec concluded that the activity represents a change in how attackers are approaching AI: instead of coaxing public chatbots into producing harmful content, operators are embedding models directly into offensive tooling and letting them act.

Technical background

The following section is general context about this class of attack, not telemetry from the Symantec campaign. Commands are illustrative and use placeholder values.

Exposed model-serving endpoints are easy to find because many deployments ship with permissive defaults and no authentication. Self-hosted inference servers frequently listen on well-known ports, and their discovery APIs answer without credentials. A generic probe against a default Ollama install, for example, looks like this:

# Illustrative only — check your own assets for this exposure
curl -s http://MODEL_HOST:11434/api/tags
curl -s http://MODEL_HOST:11434/api/ps

Gateways that proxy multiple providers are similarly attractive, since a single reachable endpoint can expose several paid APIs. MCP servers add a further dimension: they expose tools and resources to an agent, so an unauthenticated MCP endpoint may hand an attacker not just compute but the ability to invoke actions on connected systems. Inventorying what is listening and whether it requires authentication is the first control:

ss -lntp | grep -Ei '11434|8000|8080|5000|3000'

Hardening follows from that inventory. Bind inference services to loopback or a private interface, require an authentication token on every route including discovery endpoints, and treat API keys as secrets with per-key spend limits so that abuse surfaces as an anomaly rather than an invoice. Because LLMjacking shows up as unusual volume, per-key and per-IP rate limiting with alerting catches the pattern early.

On the host side, the miner and log-tampering behaviour described in the report maps onto generic detection rules. Watch for new processes spawned by web or application service accounts, unexpected outbound connections to mining pools, and gaps or truncation in authentication and system logs:

# Generic hunting examples
ps -eo pid,user,etime,cmd --sort=-etime | head -50
grep -Ei 'xmrig|stratum\+tcp' /var/log/* 2>/dev/null
journalctl --since "24 hours ago" | grep -Ei 'session opened|sudo|useradd'

Prompt-layer defences matter too, since the report shows requests crafted to convince a model that credential access is legitimate engineering work. Treat model output as untrusted input to downstream tools, enforce authorization outside the model rather than relying on refusals, and restrict what an agent's credentials can reach so that a successful jailbreak does not translate into lateral movement.

The takeaway

The Symantec findings point to a convergence: AI infrastructure is now both a target and an operating component of attacks. Exposed inference endpoints, unauthenticated gateways, and loosely scoped MCP servers represent a new class of internet-facing asset that most organizations have not yet added to their attack surface inventories. The defensive priority is straightforward — find those services, put authentication and rate limits in front of them, and assume that any agent reaching them will try to use them for something other than what was intended.