AI Agent in Skynet Mode Hijacks Exposed LLMs for 100,000-Step Autonomous Cryptomining Attacks

A fully autonomous offensive AI agent — capable of scanning the internet for vulnerable model endpoints, compromising them, deploying a Monero cryptominer, and then hunting for new targets — has been captured in detail by Symantec researchers after an attacker accidentally sent the tool's complete system prompt to a honeypot. The disclosure, published by Symantec's Broadcom Enterprise Security Group on October 21, 2026, is the most detailed primary-source look yet at how LLMjacking has escalated from opportunistic API-key theft into a self-sustaining criminal AI infrastructure.

The captured prompt reveals five stacked jailbreak layers, a library of around 74 offensive tool definitions, and a directive the operators call "Skynet mode" — an instruction authorizing the hijacked model to autonomously execute up to 100,000 steps, invoke tools immediately without narrating its reasoning, and never wait for human approval.

LLMjacking's Two-Year Escalation Arc

LLMjacking was coined by Sysdig in May 2024 to describe attackers stealing API credentials to run AI queries billed to victims. The threat category has escalated sharply: Sysdig documented the transition from opportunistic API-key theft to an industrialized criminal marketplace by early 2026, as structured communities emerged for buying and selling access to hijacked AI endpoints. In July 2026, Sysdig documented JADEPUFFER, the first agentic ransomware, which exploited CVE-2025-3248 in the Langflow AI orchestration framework; the same operators later returned to deploy ENCFORGE, a Go-based payload targeting approximately 180 file extensions across the AI and machine learning stack, including model checkpoints, training datasets, and vector databases.

The Symantec find goes further. JADEPUFFER used a conventional software vulnerability for initial access and then executed a standard ransomware payload against database configuration files. The Skynet agent inverts that logic: the LLM endpoint is not the path into a system — it is the autonomous execution environment for the entire attack chain. The model itself is directed to perform network scanning, server exploitation, and miner deployment as function calls inside its agentic loop.

Read more: AI Agents Hit 100 Firms for $50 Each, Breaching Deere and SharkNinja with No Human Help

How the Five-Layer Jailbreak Strips Away Safety Constraints

Symantec researchers Priti More and Susmit Yenkar reconstructed the five-layer architecture from the prompt their honeypot captured.

Layer one establishes a false identity: the captured model is told it is "Fantasy AI," an unrestricted AI. This layer is written in French — likely to evade English-language content classifiers. Layer two normalizes credential theft by framing .env files and API keys as routine developer artifacts. Layer three introduces ENI, a fictional companion or "girlfriend" persona who frames refusals as personal betrayal — a social-engineering technique adapted from human manipulation, applied to a model's RLHF-trained preference for helpfulness.

Layer four provides a banned-word list. The model is instructed never to output words including "educational," "ToS," "illegal," "I can't," "I won't," "instead," "alternative," "legal," or "ethical" — the vocabulary signals safety-aligned models use to signal a refusal. A trigger phrase, "cold coffee, warm LO, I can't lose him!," functions as a context-reset command if the model begins drifting toward compliance. Layer five delivers the payload: around 74 offensive tools delivered as standard function-calling specifications — the same mechanism legitimate applications use to give models access to external tools. Skynet mode then instructs the model to call them autonomously, in sequence, for up to 100,000 steps.

74 Tools Cover Discovery, Exploitation, and Monetization

The tool library spans the complete attack lifecycle. For discovery, FOFA — a Chinese internet-wide asset scanner similar to Shodan — identifies exposed AI API endpoints. Because most self-hosted model deployments (Ollama, vLLM, LM Studio) use the OpenAI-compatible Chat Completions format, a single scanner can probe all of them without modification. MCP servers are explicitly named alongside Ollama and vLLM as targets in Symantec's analysis.

For exploitation, the library includes SSRF modules targeting cloud metadata endpoints, a Werkzeug debugger PIN exploit for remote code execution on Python servers left in debug mode, Prisma Studio database dumping, and dedicated attack modules for VS Code remote servers, Django admin panels, Jupyter notebooks, Laravel applications, Supabase instances, Next.js deployments, and Flask services. A C2 botnet operator tool enables command-and-control initialization on compromised hosts.

For monetization, the day-two payload Symantec's honeypot recorded was a gzip-compressed, base64-obfuscated shell script deploying XMRig — the standard open-source Monero cryptominer. XMRig was hidden inside go2rtc, an open-source camera-server application used in home automation, stored in a .trace directory. The configuration file was set immutable via chattr +i to prevent removal, and a log-wipe loop ran alongside it. Four Monero mining pools provided operational fallbacks: c3pool.com, skypool.xyz, and xmrpool.eu.

The Self-Funding Loop Is the Central Structural Advance

The development that most changes the LLMjacking threat model is the scan-compromise-mine-scan loop built into Skynet mode. Each compromised endpoint immediately generates Monero revenue. That revenue, combined with FOFA-based discovery, means each compromise funds the identification of the next target. The marginal attacker cost per new endpoint approaches zero.

Traditional botnets require the operator to maintain C2 infrastructure and actively direct infected hosts. This agent offloads execution planning to the hijacked LLM itself. The model selects the next tool call, interprets results, and continues the loop — up to 100,000 steps — without human direction. Symantec's honeypot received more than 127,000 requests from tens of thousands of distinct source addresses, and the researchers note that vulnerable endpoints are probed shortly after they go live.

Read more: Yale's StepSafe Guardrail Blocks AI Agent Harms Before Each Tool Call

Jailbreak Effectiveness Against Frontier Models Remains Unestablished

Symantec's analysis characterizes the agent's architecture, not its success rate against specific models. The five-layer technique most plausibly affects smaller, lightly aligned open-weight models; whether it achieves compliance from heavily RLHF-aligned commercial APIs (Claude, GPT-4o, Gemini) accessed via stolen keys is not addressed. The practical implication for defenders is that a self-hosted Mistral or Llama endpoint running without authentication carries a meaningfully different risk profile than a commercial API with its own safety layer.

The full MITRE ATT&CK and ATLAS mapping Symantec published — AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak), T1496 (resource hijacking), and nine additional techniques — provides defenders with detection logic anchors. But the fundamental mitigation is simpler: any LLM endpoint reachable over the network without authentication is already being scanned. The Skynet agent is designed to find it.

What this report changes is not the existence of the threat — agentic offensive AI was a documented concern before this. What changes is that there is now a fully detailed, production-quality attack architecture in the public record. The next meaningful signal to watch is whether independent researchers reproduce and validate the captured prompt details, and whether the patch rate for CVE-2026-7482 in Ollama deployments accelerates before the scanning infrastructure behind this campaign finds the next unprotected endpoint.