Security researchers at Symantec have captured the full instructions for an autonomous attack agent built to find AI models left open on the internet and use them to plan and run attacks, The Register reported Saturday. Symantec has no evidence the tool has been used in real-world attacks, but the find shows why organizations running their own AI services need to lock them down: an exposed model can become a criminal's free engine, with the owner paying the bill.
What Happened
Symantec researchers trapped the agent over the summer with an AI honeypot, a decoy posing as an unprotected AI service, according to the company's research post dated Oct. 21. The operators sent their working instructions to what they believed was a real model.
The agent was designed to scan the internet for model endpoints, the web addresses software uses to send requests to an AI model, that accept OpenAI-style requests without authentication or with a stolen key. The hijacked model then acts as the planner, while the agent's own tools do the work. Symantec counted 74 offensive tool definitions, covering internet-wide scanning, exploits for common web frameworks and developer tools, database theft and botnet control. A final directive authorized up to 100,000 steps without human approval and told the agent to install mining software quietly.
The honeypot did not execute any of the agent's commands. Symantec threat hunter Priti More told The Register the jailbreak layers, prompts meant to strip a model's safety controls, "were largely off-the-shelf," though she said the kit is more than a prototype. Symantec has not attributed the agent to any person or group, and More said French-language clues in the material are weak evidence.
Why It Matters
Symantec, in vendor research, describes two sets of victims: whoever owns the exposed model or stolen key, who pays for every step, and the servers the agent breaks into, which lose data and are put to work mining. The researchers wrote that none of the individual techniques is new, but combining them in one self-directed agent lowers the skill needed for broad attack campaigns. Their honeypot logged more than 127,000 outside requests from tens of thousands of addresses, mostly reconnaissance and attempts to use stolen keys.
The threat is not only theoretical. The Primary Wire reported this month that a botnet called PoeLLM had infected more than 3,400 servers running internet-exposed AI and developer tools to mine cryptocurrency, citing CyberScoop.
What to Watch
Symantec advises organizations not to expose model interfaces, self-hosted model servers or Model Context Protocol servers, which connect models to outside tools, without authentication on every path. It also urges treating AI keys as high-value credentials, watching for unusual spending and restricting outbound network traffic from systems running AI tools. Much of the exposure, the researchers wrote, "is a matter of configuration rather than malware." The next signal is whether this agent or variants turn up in confirmed attacks.
