Symantec Details ‘Skynet’ Agent Hijacking Exposed AI Models to Power Attacks

Oct 21, 2026 · Original article ↗

Summary

Symantec researchers used an AI honeypot to capture instructions for an autonomous agent targeting exposed LLMs, plus a separate mining script. The agent was designed to exploit systems, steal data and credentials, and mine cryptocurrency.

Key points

The captured agent instructions targeted unauthenticated or otherwise exposed AI endpoints, shifting model-computing costs to their owners.
Its tool catalogue included internet-wide scanning, web-framework exploitation, database and credential theft, SSRF, and botnet management.
The operators described an unattended “Skynet” mode capable of up to 100,000 steps and quiet cryptocurrency-miner deployment.
A separate request contained an obfuscated shell script that downloaded or compiled XMRig, used failover mining pools, and attempted to hide and protect the miner.
The script appeared tailored to systems running go2rtc, including camera gateways; the honeypot captured the requests but did not execute them.
Symantec recommends authenticating AI endpoints, protecting API keys, restricting outbound access, limiting agent privileges, and requiring human approval for sensitive actions.

Article Details

Attack Vectors: Operators searched for exposed, unauthenticated LLM endpoints and used them to run an autonomous offensive agent, shifting inference costs to the model owner.
The agent's captured instructions described scanning targets, exploiting web frameworks and exposed services, harvesting credentials and secrets, dumping databases, and deploying cryptocurrency miners.
A separate captured shell script downloaded or compiled XMRig, concealed the miner, configured multiple mining pools, set an immutable configuration file attribute, and repeatedly deleted local service access logs. The honeypot captured but did not execute the script.
Defensive Notes: Require authentication for all internet-facing LLM APIs, model servers, gateways, and MCP endpoints, including model-listing and health-check paths; place services behind a gateway.
Treat AI API keys as high-value credentials: rotate them, scope them narrowly, keep them out of source code and configuration files, and monitor inference volume and spend.
Restrict outbound network access from systems hosting AI services or tool-enabled agents.
On cloud workloads, enforce Instance Metadata Service version 2 with a hop limit of one to reduce SSRF-based metadata access.
Run tool-enabled agents with least privilege and require human approval for sensitive actions; patch and avoid publicly exposing software named in the article, including VS Code servers, Django, Jupyter, Laravel, Supabase, and Prisma Studio.

Indicators of compromise

Type	Indicator	Context
HOSTNAME	`auto[.]c3pool[.]org`	Mining-pool hostname listed in the article's Network IOCs.
HOSTNAME	`auto[.]skypool[.]xyz`	Mining-pool hostname listed in the article's Network IOCs.
HOSTNAME	`mine[.]c3pool[.]com`	Mining-pool hostname listed in the article's Network IOCs.
HOSTNAME	`xmrpool[.]eu`	Mining-pool hostname listed in the article's Network IOCs.
IPV4	`13[.]140[.]161[.]91`	Address listed in the article's Network IOCs.
IPV4	`207[.]180[.]232[.]206`	Address listed in the article's Network IOCs.
IPV4	`86[.]216[.]147[.]228`	Address listed in the article's Network IOCs.
SHA256	`b720a5e7c3a5b1760d15a8833a782f4fe7fc5c62b967fe57f607e72745ec0ccf`	Hash listed as an IOC for the gzip-compressed shell script associated with cryptocurrency mining.
SHA256	`fcde1323acceb46fd88f2276c010bb98839dccce03dc512c56d9529428ceec68`	Hash listed as an IOC for the captured shell script associated with cryptocurrency mining.