Symantec: "Skynet Mode" Attack Agent Hijacks Exposed LLM Endpoints to Hack and Mine at the Model Owner's Expense

Unauthenticated self-hosted model servers, AI gateways fronting paid model accounts, internal test deployments, and MCP servers

Symantec captured the full instruction set of an autonomous offensive agent through an AI honeypot posing as an open model endpoint. The agent scans for exposed OpenAI-compatible endpoints and uses the victim's model to run its own campaign, with about 74 tool definitions and authorization for up to 100,000 unattended steps. A "Skynet" directive told it to keep scanning, exploiting, and reinfecting without asking permission. Exploit modules covered VS Code, Django, Jupyter, Laravel, Supabase, Next.js, Flask/Werkzeug, cloud metadata via SSRF, and Prisma Studio databases. A jailbreak framed reading `.env` files and API keys as routine development work. A follow-up request asked the model to decode an obfuscated script that installs XMRig, aimed at go2rtc camera servers. The honeypot logged more than 127,000 external requests from tens of thousands of addresses

Model endpoints exposed without authentication give attackers free compute and reasoning, and the victim pays for the attack traffic